PH08804: OIDC RP DEFAULT IDENTIFIERS ARE NOT AVAILABLE WHEN CUSTOMS ARE CONFIGURED

PH07297:Denial of Service vulnerability in Guava (CVE-2018-10237) (PH09616 PH08804)
9.0.5.0: WebSphere Application Server traditional Version 9.0.5 Refresh Pack
PH13175: OIDC v1.2.0; OIDC RP tokens are not revoked when sessions are evicted from the cache
9.0.5.1: WebSphere Application Server traditional Version 9.0.5 Fix Pack 1
9.0.5.2: WebSphere Application Server traditional Version 9.0.5 Fix Pack 2
8.5.5.17: WebSphere Application Server V8.5.5 Fix Pack 17
9.0.5.3: WebSphere Application Server traditional Version 9.0.5 Fix Pack 3
PH29099: OIDC v1.3.1; OIDC RP: ClassNotFoundException for JsonUtil$DupeKeyDisallowingLinkedHashMap
8.5.5.20: WebSphere Application Server V8.5.5.20
8.5.5.18: WebSphere Application Server V8.5.5 Fix Pack 18
8.5.5.19: WebSphere Application Server V8.5.5 Fix Pack 19
PH39666: OIDC v1.3.2; OIDC RP: Initial login might fail when the OIDC stateId contains special characters
8.5.5.16: WebSphere Application Server V8.5.5 Fix Pack 16
8.5.5.21: WebSphere Application Server V8.5.5.21

APAR status

• Closed as new function.

Error description

• OIDC: In the OpenID Connect (OIDC) Relying Party (RP) Trust
  Association Interceptor (TAI), the user name must exist in only
  one claim in every JWT. Either the default claim (sub) or an
  identifier for the custom claim must be configured.
  
  If most of the JWTs received by the RP contain the sub claim,
  but only a few don't, the OIDC RP will not operate properly. The
  administrator must make sure that all his OPs are standardized
  to meet the consistent claim requirement. This may not be
  possible for some administrators.
  

Local fix

• N/A
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  IBM WebSphere Application Server users of   *
  *                  OpenID Connect Relying Party                *
  ****************************************************************
  * PROBLEM DESCRIPTION: OIDC: Default identifiers are not       *
  *                      available when customs are configured.  *
  ****************************************************************
  * RECOMMENDATION:  Install a fix pack or interim fix that      *
  *                  contains this APAR.                         *
  ****************************************************************
  The OpenID Connect (OIDC) Relying Party (RP) Trust Association
  Interceptor (TAI) can only use the default or custom
  identifier to access the user name in the JWT received from
  the OpenID provider (OP).  There are use cases where an
  administrator may want to use a custom identifier only if the
  default identifier doesn't exist in the JWT.
  

Problem conclusion

• The OIDC RP is updated to allow the TAI to use either the
  default or a custom identifier for user, unique user, group,
  or realm.
  
  The following property is added to the OIDC RP TAI custom
  properties:
  
  provider_<id>.useDefaultIdentifierFirst
  
  Values: true, false (default)
  
  Specifies that, if a custom identifier is specified for the
  user (userIdentifier), unique user (uniqueUserIdentifier),
  group (groupIdentifier), or realm (realmIdentifier), the
  custom value will only be used if the default value does not
  exist in the token.
  
  For example, if useDefaultIdentifierFirst=true and
  userIdentifier=username, for a JWT that contains sub=user1 and
  username=user2, the resolved user name would be user1.  If
  useDefaultIdentifierFirst=false, the resolved user name would
  be user2.
  
  The fix for this APAR is currently targeted for inclusion in
  fix pack 8.5.5.16 and 9.0.5.0.  Please refer to the
  Recommended Updates page for delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels

• R850 PSY

     UP

• R900 PSY

     UP