Handling incoming SAS requests from WebSphere AS

Question

I have a couple of beans deployed on a WLS 8.1.2 instance that try to call other
beans deployed on a WAS 5.0.2 instance. With "global security" on WAS disabled,
all works fine, but with this enabled (but no security constraints on calling
the bean itself), my local WLS fails when handling a n incoming SAS request from
WAS (I see this by turning on IIOP-debug in WLS).
The SAS request contains a usernamescope with value "weblogicDEFAULT", username
"UNAUTHENTICATED" and password null. This request is partially processed in WLS
by a class called weblogic.iiop.csi.GSSUPImpl, and this class contains a line
like this:
password = new String(abyte3, "UTF8");
resulting in a NPE when the password is null.
If I decompile GSSUPImpl, set a password if null AND create a WLS user with name
"UNAUTHENTICATED" and the password I set, then things work ok. But this is of
course not a desired situation.
Anybody know if there is a WLS-configuration setting to prevent this, or if perhaps
there is a setting in WAS to prevent it from sending the "UNAUTHENTICATED" token
along with the request?
I've tried this on both WLS 8.1.2 on w2k and WLS 8.1.2 on HP-UX 11i, and with
WAS on Solaris and WAS on winXP - all with the same result. JVM 1.4.2_02 from
Sun, and 1.4.1_05 from HP.
Both WAS servers are configured to use only CSI (there is also an option of using
CSI and SAS).
Regards,
Bjørn Ellingsen
(cross posted to weblogic.developer.interest.rmi-iiop)

Answer 1

"Bjorn Ellingsen" <[email protected]> wrote in message
news:4055949a$[email protected]..
>
>
I have a couple of beans deployed on a WLS 8.1.2 instance that try to callother
beans deployed on a WAS 5.0.2 instance. With "global security" on WASdisabled,
all works fine, but with this enabled (but no security constraints oncalling
the bean itself), my local WLS fails when handling a n incoming SASrequest from
WAS (I see this by turning on IIOP-debug in WLS).
The SAS request contains a usernamescope with value "weblogicDEFAULT",username
"UNAUTHENTICATED" and password null. This request is partially processedin WLS
by a class called weblogic.iiop.csi.GSSUPImpl, and this class contains aline
like this:
password = new String(abyte3, "UTF8");
resulting in a NPE when the password is null.
The NPE sounds like a bug. I would file a support case.
If I decompile GSSUPImpl, set a password if null AND create a WLS userwith name
"UNAUTHENTICATED" and the password I set, then things work ok. But this isof
course not a desired situation.
Anybody know if there is a WLS-configuration setting to prevent this, orif perhaps
there is a setting in WAS to prevent it from sending the "UNAUTHENTICATED"token
along with the request?
You may be able to specify something with the iiop-security-descriptor. A
value of
none or supported may control the WAS behavior.
<client-authentication>supported<client-authentication>If none or supported,
WAS should send no username if the user is unauthenticated.
http://e-docs.bea.com/wls/docs81/security/ejb_client.html#1034805