Impact: This advisory affects any production ISIS application that is dynamically retrieving WSDL at run time to determine the ISIS web service location.

This information was posted on isisdev-l in a ISIS 5 rollout status update on 9/10/2006.

Problem

The Microsoft .NET framework provides a dynamic WSDL generation mechanism for web services written in .NET. Historically, we have pointed the developers to this automated mechanism to retrieve ISIS WSDL.

ISIS 5 uses AIS’s Cicso content switch to provide load balancing services. The particular configration causes the .NET framework on the ISIS server to incorrectly set the WSDL service location within the dynamically generated WSDL.

In normal cases, this is not a problem since an ISIS application typically set the actual web service location within its configuration fiile.

However, if an application retrieves the WSDL at runtime with each call, the incorrect WSDL will point the application to to an incorrect web service address.

Workaround

We have published a correct production ISIS WSDL at:

https://i4w.ais.ucla.edu/iws/v4.wsdl

Additional Consideration

As a general rule, we do not recommend loading the WSDL from a remote website dynamically at runtime. Until we move to a UDDL enabled environment, retrieving the WSDL dynamically only creates unnecessary connection overhead.