Upgrading to WebSphere Portal 7 – Problems with JSF

Anyone who has gone through a WebSphere Portal upgrade and has portlets which use JSF has likely had some issues.  I am currently working on a portal 6.0.x to 7.0.x migration and want to share a massive JSF challenge to hopefully spare others some pain.  The problem created is that  <hx:requestLink /> tags are blocked by SiteMinder. Here is what I ran accross.

Out of the box if you create a simple link that looks like this:

<hx:requestLink styleClass=”requestLink” id=”link1″>
      <h:outputText id=”text1″ styleClass=”outputText” value=”Link Test”></h:outputText>
</hx:requestLink>

Portal 7 will generate a URL that looks like this:

Revolutionize Your Business With Generative AI

From product design and software development to virtual agents, content creation, and reporting, GenAI is transforming business. Our AI experts help you unlock GenAI’s full potential and drive growth.

Let’s Get Started

http://dev.perficient.com:10039/wps/myportal/!ut/p/b1/dczLboMwEIXhZ8kTzAGDDUsH09gtIdhACt5ESL0oqEmqNopanr5UyqaqMruR_vORpz7gXLCQJ4GgjvxxuOxfh_P-dBzefn_Pd3mldHwnNjWabQhTSbT3jgMZ6JE6RLt6TN7X3-eumLJLM0411spOZdN_lZMMy7SonrauXUo5flrU88b_ZTeximB0lLOgYADYNcCNk_gn5CqDSY2xlXEzwa9BtpI6EgWQFKsYRurWpZYxSEalPh2eqZ8zcdN5CKmhfkkH_8Fd_qKsXCx-AJjeIEY!/pw/Z7_EPDH5F7OS0TV20IPA0UJR600C5/ren/p=_rvip=%250JSFLinkTestView.jsp/p=_rap=_rlnn/p=com.ibm.faces.portlet.mode=view/p=javax.servlet.include.path_info=%250_rlvid.jsp/-/#Z7_EPDH5F7OS0TV20IPA0UJR600C5

First, notice that the parameters are available in clear sight in the URL.  This did not work this way previously in portal 6 and depending what you are doing there could be obvious security concerns here and possibilities of URL hacking.  If you add your own parameters to the requestLink, they will now show in clear text in the URL.

Second, notice the %250 in two places that gets added to the URL.  This is inserted internally by JSF.  This is an enormous problem if you are using SiteMinder.  SiteMinder sees the %25 and instantly blocks the URL and throws an HTTP 500 error before even hitting the web server or the portal since this is by default a prohibited character in the URL by SiteMinder.  Now, all of your <hx:requestLink /> tags are usless.

So, what can you do?  Well I solved the problem by using an <h:commandLink /> instead.  If you rely on request parameters from your link you will need to read them in your action phase and set them as render parameters as such:

Enumeration e = request.getParameterNames();
while(e.hasMoreElements()){
      String name = (String)e.nextElement();
      response.setRenderParameter(name, request.getParameter(name));
}

If you have the opportunity to migrate to Spring MVC instead of using JSF, that might be your best solution.

Happy migration.