Explanation | The missing attribute is required for the <securityConfiguration> element. |
Action | Specify the missing attribute for the <securityConfiguration> element. |
Explanation | The specified configuration element type requires an id attribute so it can be properly referenced by other elements in the configuration. |
Action | Define an id attribute for the specified configuration element type. |
Explanation | The missing attribute is required for the <security> element. |
Action | Specify the missing attribute for the <security> element. |
Explanation | The specified security configuration is not defined. The identifier name might be incorrect, or referencing a security configuration that does not exist. |
Action | Define a valid security configuration for the specified attribute in the <security> element. |
Explanation | The configured reference identifier is not valid. The identifier name might be wrong, or referencing a service configuration that does not exist. |
Action | Specify a valid service configuration identifier for the <securityConfiguration> element. |
Explanation | No service of the specified type is available through the OSGi service registry. |
Action | Specify a service implementation feature of the specified type. |
Explanation | Multiple services of the specified type are available through the OSGi service registry, and no explicit configuration exists to indicate which service to use. |
Action | Specify only one service implementation feature of the specified type, or define which service to use in the configuration. |
Explanation | The security service is in the process of starting. This might take some time if one-time initialization needs to occur. |
Action | No action is required. |
Explanation | This message is for informational purposes only. |
Action | No action is required. |
Explanation | This message is for informational purposes only. |
Action | No action is required. |
Explanation | The caller's subject has too many principals of type WSPrincipal. Only one principal of this type is supported. |
Action | Review the application to understand why the subject has more than one WSPrincipal. |
Explanation | The SPNEGO API cannot be used with the Java runtime vendor and version. |
Action | Use the Java vendor and version that is supported by the SPNEGO APIs. |
Explanation | While recreating the subjects that were in the security context, an authentication error occurred. As a result, the unauthenticated subject will be used instead. |
Action | Review the exception and logs to understand why the authentication failed. |
Explanation | The security context could not be deserialized because the subject has too many principals of type WSPrincipal. Only one principal of this type is supported. |
Action | Review the application to understand why the subject has more than one WSPrincipal. |
Explanation | The custom cache key for the subject could not be serialized while serializing the security context. Although the security context will not contain the custom cache key, this does not affect the serialization of the security context itself. |
Action | Review the logs to understand why the serialization of the custom cache key failed. |
Explanation | The <quickStartSecurity> element is missing the required attributes. |
Action | Define the required attributes. |
Explanation | The <quickStartSecurity> configuration is only used when no other UserRegistry configuration is specified. |
Action | Use only one user registry configuration. |
Explanation | The <quickStartSecurity> configuration is only used when no explicit management security authorization bindings are defined. |
Action | Use <quickStartSecurity> and remove the explicit management security authorization bindings, or configure a different user registry. |
Explanation | The Authentication Service is not configured with the JAAS Service. |
Action | No action is required. |
Explanation | The specified user ID, or the associated password, is not valid. |
Action | Verify that the user ID and password are entered correctly. Consult with the administrator of the user registry if the problem persists. |
Explanation | The specified client certificate does not map to a user in the registry. |
Action | Ensure the client supplies a certificate that maps to a user in the registry. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: http://www.ibm.com/software/webservers/appserv/was/support/ WebSphere Application Server for z/OS Support page: http://www.ibm.com/software/webservers/appserv/zos_os390/support/ . |
Explanation | The authentication did not succeed because there is no JAR file for the JAAS custom login module. |
Action | Ensure the JAAS custom login module has a valid JAR file. |
Explanation | The authentication did not succeed because there is no login module defined for the login module reference. |
Action | Ensure the loginModuleRef element has a configured jaasLoginModule element. |
Explanation | An internal error occurred. |
Action | See the problem determination information on the WebSphere Application Server Support web page: http://www.ibm.com/software/webservers/appserv/was/support. |
Explanation | The authentication did not succeed because the specified user ID is not valid. |
Action | Verify that the user ID is entered correctly. Consult with the administrator of the user registry if the problem persists. |
Explanation | The authentication did not succeed because the WSLoginModuleProxy options element is null or empty. |
Action | Verify that the WSLoginModuleProxy configuration includes the options element. |
Explanation | The authentication did not succeed because the WSLoginModuleProxy delegate option is not set. |
Action | Verify that the WSLoginModuleProxy configuration includes the delegate option. |
Explanation | The WSLoginModuleProxy is not supported in the jaasLoginContextEntry system.DEFAULT. |
Action | Remove the proxy entry from the loginModuleRef attribute of the jaasLoginContextEntry system.DEFAULT. |
Explanation | The jassLoginContextEntry has no login modules specified in the loginModuleRef attribute. |
Action | Make sure that there is at least one login module specified in the loginModuleRef attribute. |
Explanation | The userIDMap LDAP filter could not determine the display name of the user. The security name will be returned for the principal name for the programmatic API calls like getUserPrincipal. |
Action | If the user should have a displayName, make sure that the user is created in LDAP to match the userIdMap filter that is configured. |
Explanation | The same name is defined by more than one jassLoginContextEntry element. As a result, the original value is overwritten by another value. |
Action | Make sure that every jaasLoginContextEntry element has a unique id and name. |
Explanation | A collective authentication plugin has been activated, and is now available to authenticate collective requests. |
Action | No action is required. |
Explanation | A collective authentication plugin has been deactivated, and is no longer available to authenticate collective requests. |
Action | No action is required. |
Explanation | The authentication cache clears all entries in the backing JCache cache when security or user registry configuration is modified, or when the DeleteAuthCache MBean is called. |
Action | No action is required. |
Explanation | The entry contents were not serialized so they were not stored in the JCache authentication cache. |
Action | Investigate the exception included in the message and fix the cause of the error. |
Explanation | The entry could not be retrieved from the JCache authentication cache. |
Action | Investigate the exception included in the message and fix the cause of the error. |
Explanation | The entry was not not stored in the JCache authentication cache. |
Action | Investigate the exception included in the message and fix the cause of the error. |
Explanation | The entry was not removed from the JCache authentication cache. |
Action | Investigate the exception included in the message and fix the cause of the error. |
Explanation | The entries were not cleared from the JCache authentication cache. |
Action | Investigate the exception included in the message and fix the cause of the error. |
Explanation | A MalformedURLException occurred trying to connect to the specified URL. |
Action | Investigate the exception. Check the specified URL. |
Explanation | An IOException occurred trying to connect to the specified URL. |
Action | Investigate the exception. Check the specified URL. |
Explanation | An IOException occurred trying to connect to the specified URL. |
Action | Investigate the exception. Check the specified URL. |
Explanation | A Duplicate login configuration name was specified in the configuration data. |
Action | Check the configuration data. |
Explanation | An IOException occurred during parsing of the JAAS application configuration. |
Action | Check the configuration file. Investigate the exception. |
Explanation | A ParserException occurred during parsing of the JAAS application configuration. |
Action | Investigate the exception, which has the information of the syntax error in the configuration file. |
Explanation | The default jaasLoginContextEntry can not be specified in the JAAS configuration file. |
Action | Verify that the JAAS configuration file does not have a default jaasLoginContextEntry. |
Explanation | The specified OSGi service is not available. |
Action | Restart the server with the "clean" option. |
Explanation | Exception performing class for name. |
Action | Verify that all custom JAAS login modules specified in the JAAS configuration file exist in the default JAAS directory. The default JAAS directory for the server is ${server.config.dir}/resources/security/jaas; The default JAAS directory for the client is ${client.config.dir}/resources/security/jaas. |
Explanation | A Duplicate login configuration name was specified in the JAAS configuration file and server.xml/client.xml file |
Action | Check the JAAS configuration file and server.xml/client.xml file. |
Explanation | The Krb5LoginModule module specified in the server.xml file, the jaas.conf file, or both files is not supported in the Java vendor and version that was used. |
Action | Use the correct Java vendor and version that is supported for the Krb5LoginModule module or use a Krb5LoginModule module that is supported by the Java vendor and version. |
Explanation | The Krb5LoginModule options specified in the server.xml file, the jaas.conf file, or both files is not supported in the Java vendor and version that was used. |
Action | Verify that all the Krb5LoginModule options that are specified in the server.xml file, the jaas.conf file, or both files are supported by the Java vendor and version. |
Explanation | The run time uses a default Krb5LoginModule configuration and the SPNEGO configuration in the server.xml file. |
Action | Remove the jaasLoginContext entry from the server.xml file or let the run time use the default entry. |
Explanation | You must specify only one attribute, libraryRef or classProviderRef, to indicate the artifact from which to load the JAAS custom login module. |
Action | Remove either the libraryRef attribute or the classProviderRef attribute, whichever does not contain the JAAS custom login module class. |
Explanation | You must specify exactly one attribute, libraryRef or classProviderRef, to indicate the artifact from which to load the JAAS custom login module. |
Action | Specify either the libraryRef or classProviderRef attribute to indicate the location from which to load the JAAS custom login module class. |
Explanation | The specified application or resource adapter does not contain the requested JAAS custom login module class or the JAAS custom login module class is present within the application, but in a location from which it cannot be loaded. |
Action | Make sure the configured JAAS custom login module class and its package name are correct. If an application is specified, the login module class must be contained within the application, within either a top level JAR or a resource adapter module. |
Explanation | The jassLoginContextEntry has no login modules specified in the loginModuleRef. |
Action | Make sure that there is at least one login module specified in the loginModuleRef. |
Explanation | The authentication did not succeed because there is no login module defined for the login module reference. |
Action | Ensure the loginModuleRef element has a configured loginModule property. |
Explanation | The same name is defined by more than one jassLoginContextEntry. As a result, the original value is overwritten by another value. |
Action | Make sure that every jaasLoginContextEntry has a unique id and name. |
Explanation | The login on the client application failed because the class implementing the CallbackHandler interface is null. Because there is no CallbackHandler, there is no way to gather credentials for a user that wants to log in. Ensure a valid CallbackHandler implementation is specified either in the LoginContext constructor or in the client application's deployment descriptor. |
Action | Ensure a valid CallbackHandler implementation is specified either as an argument to the LoginContext constructor or in the client application's deployment descriptor. |
Explanation | The login on the client application failed because the user name or password is null. Ensure the CallbackHandler implementation is gathering the necessary credentials. The CallbackHandler can be specified either in the LoginContext constructor or in the client application's deployment descriptor. |
Action | Ensure the CallbackHandler implementation is gathering the user name and password. |
Explanation | The login on the client application failed because of an unexpected exception. Review the logs and FFDC entries to understand and correct the cause of the exception. |
Action | Review the logs and FFDC entries to understand and correct the cause of the exception. |
Explanation | This message is for informational purposes only. |
Action | No action is required. |
Explanation | This message is for informational purposes only. |
Action | No action is required. |
Explanation | This message is for informational purposes only. |
Action | No action is required. |
Explanation | The Trust Association could not initialize. |
Action | Verify that the appropriate Trust Association classes are installed and the classpath is correct. |
Explanation | The interceptor class file specified in trustedservers.properties cannot be found. |
Action | Verify that the appropriate Trust Association classes are installed and the classpath is correct. Also verify that the class specified in the trustedservers.properties file is correct and that the file has at least read permission. |
Explanation | A ClassNotFoundException occurred when trying to load the subject class. |
Action | Check that the setup and classpath are correct, and the appropriate Trust Association classes are installed. |
Explanation | The specified properties must define both a name and a value. |
Action | Define a name and value for the properties for the interceptor. |
Explanation | The specified TAI does not have a shared library. |
Action | Ensure that the TAI has a valid JAR file. |
Explanation | The specified alias is required. |
Action | Specify a valid authentication data alias for an existing user, or configure a new authentication data alias. |
Explanation | The specified attribute must be defined. |
Action | Specify the value for the missing attribute. |
Explanation | The specified attributes are mutually exclusive with one another. |
Action | Specify only one of the two attributes. |
Explanation | The WSMappingCallbackHandler used to perform the DefaultPrincipalMapping JAAS programmatic login did not contain a java.util.Map parameter. |
Action | Verify that the application performing the DefaultPrincipalMapping JAAS programmatic login creates the WSMappingCallbackHandler with a java.util.Map instance. |
Explanation | The java.util.Map parameter of the WSMappingCallbackHandler used to perform the DefaultPrincipalMapping JAAS programmatic login did not contain a value for the com.ibm.wsspi.security.auth.callback.Constants.MAPPING_ALIAS entry. |
Action | Verify that the application performing the DefaultPrincipalMapping JAAS programmatic login creates the WSMappingCallbackHandler with a java.util.Map instance with a value for the com.ibm.wsspi.security.auth.callback.Constants.MAPPING_ALIAS entry. |
Explanation | Cannot get specified oauth provider configuration. |
Action | Specify a valid oauth provider configuration. |
Explanation | The OAuth provider has a mediator class specified but libraryRef is either not specified or the library is not activated. This might be a config error, or the library might have been activated after the provider had been activated. |
Action | Ensure the OAuth provider's libraryRef is correctly defined. |
Explanation | The OAuth provider has a mediator class specified and the libraryRef is activated. |
Action | None. |
Explanation | The OAuth provider's configuration has been successfully processed. |
Action | None. |
Explanation | The OAuth roles configuration has been successfully processed. |
Action | None. |
Explanation | The introspect request must have a token request parameter specifying the access token to be introspected. |
Action | Invoke the request again with a token parameter that specifies a valid access token. |
Explanation | The indicated request must have a valid client ID and password, and the client ID must match the client ID that created the access token. |
Action | Invoke the request again with a valid client credential. |
Explanation | The class name of customized Grant Type Handler cannot be instantiated. |
Action | Double check the class name in the configuration. |
Explanation | The class name of customized Grant Type Handler cannot be found. |
Action | Double check the class name in the configuration. |
Explanation | No endpoint service is available through the OSGi service registry. |
Action | Include the oauth-2.0 or openidConnectServer-1.0 feature in your server configuration. |
Explanation | The OAuth connect service is activated. |
Action | None |
Explanation | The request had a client ID that was not the same client ID that created the access token, or the request had an invalid client ID or client secret. |
Action | Invoke the request again with a valid client credential. |
Explanation | The attribute is missing from the request |
Action | Inspect the request endpoint in the server.xml file to ensure you have the right provider |
Explanation | Can not create an OAuth20Provider for the OAuth provider name |
Action | Double check the provider configuration |
Explanation | All scopes requested in the scope parameter of the token endpoint request have to be defined in the 'preAuthorizedScope' list of the client configuration. |
Action | Make sure all scopes in the token endpoint request are defined in the 'preAuthorizedScope' list of the client configuration. |
Explanation | All scopes requested in the scope parameter of the token endpoint request have to be defined in the 'preAuthorizedScope' list of the client configuration. |
Action | Make sure all scopes specified in the token endpoint request are defined in the 'preAuthorizedScope' of the client configuration. |
Explanation | The client needs to be autoAuthorized to authorize the scopes from the http request. Otherwise the scopes have to be defined in the 'preAuthorizedScope' list of the client configuration. |
Action | Make sure the client is autoAuthorized or the scopes are defined in the 'preAuthorizedScope' list of the client configuration. |
Explanation | The client indicated in the message does not support the grant type since it is not specified in the grantType list of the client configuration. |
Action | Specify the indicated grant type in the grantType list of the client configuration. |
Explanation | The token endpoint request can not contains more than one of the indicated parameters. Otherwise the OpenID Connect Provider can not process it. |
Action | Make sure only one of the indicated parameters is in the token endpoint request. |
Explanation | The request had a client ID that is not authorized to introspect tokens. |
Action | Authorize the client to introspect access tokens by setting introspectTokens to true in the OAuth client configuration. |
Explanation | The request had a client ID that is not authorized to introspect tokens. |
Action | Authorize the client to introspect access tokens by setting introspectTokens to true in the OAuth client configuration. |
Explanation | The value of the indicated attribute is too small. It is reset to the default value. |
Action | Set the indicated attribute to a proper value that is not less than the default value. |
Explanation | The value in the indicated attribute is too large. |
Action | Set the indicated attribute to a proper value. |
Explanation | The character is not allowed in client data. |
Action | Remove the illegal character and resubmit the request. |
Explanation | The request contained a client id that was not found. |
Action | Retry the request with a valid client id. |
Explanation | Clients can only be created by making a POST request to the registration end point URI. |
Action | Review the API documentation for this service, and retry the request to the registration end point URI. |
Explanation | Clients can only be created by making a POST request to the registration end point URI. |
Action | Review the API documentation for this service, and retry the request to the registration end point URI. |
Explanation | Operations can only be done on registered and valid clients. |
Action | Review the API documentation for this service, and retry the request with the appropriate parameters. |
Explanation | The JSON in the request body is malformed. |
Action | Review the API documentation for this service, and retry the request. |
Explanation | The operation failed because the client id already exists. |
Action | Review the API documentation for this service, and retry the request with the appropriate parameters. |
Explanation | TThe update request indicates that the client secret must be preserved but the existing registration has no secret set. |
Action | Review the API documentation for this service, and retry the request with the appropriate parameters. |
Explanation | An update request for a public client must not specify a client secret. |
Action | Review the API documentation for this service, and retry the request with the appropriate parameters. |
Explanation | The request cannot be completed because it specifies an invalid configuration given the current state of the client's registration. |
Action | Review the API documentation for this service, and retry the request with the appropriate parameters. |
Explanation | Only some HTTP methods are supported for a given service. |
Action | Correct the HTTP request. |
Explanation | The request to this service was denied because it is missing the required parameter {0}. |
Action | Review the API documentation for this service, and retry the request with the appropriate parameters. |
Explanation | The request to this service was denied because it is missing required parameter {0}. |
Action | Review the API documentation for this service, and retry the request with the appropriate parameters. |
Explanation | The request to this service was denied because it contains invalid parameters. Only one {0} parameter may be specified. |
Action | Review the API documentation for this service, and retry the request with the appropriate parameters. |
Explanation | The request to this service was denied because an unrecognized token type {0} was specified. |
Action | Review the API documentation for this service, and retry the request with the appropriate parameters. |
Explanation | A client_secret cannot be specified when creating a public client. |
Action | Either do not specify a client_secret or create a non-public client. |
Explanation | The request needs to provide a Client Certificate during the SSL handshake for the user authentication when the certAuthentication attribute in the oauthProvider configuration is enabled. |
Action | Enable the request with a proper Client Certificate during the SSL handshake for the user authentication and set the clientAuthenticationSupported attribute in the ssl configuration to true, or set the certAuthentication attribute to false to disable it. |
Explanation | The request needs to provide a valid Authorization header, which needs to be a valid user and password. |
Action | Make sure the Authorization header in the request has a valid user and password, and the user has to be registered in the OpenId Connect Provider. |
Explanation | Since the certAuthentication attribute in the oauthProvider configuration is enabled, the request needs to provide a Client Certificate during the SSL handshake with a valid user for the user authentication. |
Action | Make sure the Client Certificate provided during the SSL handshake in the request has a valid user, and the user has to be registered in the OpenID Connect Provider. |
Explanation | This client property is restricted to approved values and the specified value is not approved. |
Action | Review the API documentation for this service, and retry the request with an approved value. |
Explanation | The specified values for this property contain duplicates, which is not allowed. |
Action | Review the API documentation for this service, and retry the request with the appropriate property not containing duplicate values. |
Explanation | The request contains an invalid grant_type value and response_type value combination. |
Action | Review the API documentation and the OpenID Connect Client Registration specification to determine a valid grant_type value and response_type value combination. |
Explanation | The request cannot be completed because it specifies the property value with a malformed URI syntax. |
Action | Review the property value in the request and modify it to conform with a well-formed URI syntax. |
Explanation | The request cannot be completed because it specifies a non-absolute URI, when one is required. |
Action | Review the property value in the request and modify it to conform with an absolute URI syntax. |
Explanation | The request cannot be completed because the property value specified is a non-modifiable output parameter. |
Action | Remove the property value from the request, as it is not valid to specify an output parameter for create or update actions. |
Explanation | The OAuth provider has a databaseStore element specified but the dataSourceRef attribute is either not specified or the datasource is not activated. This might be due to a configuration error. |
Action | Ensure the dataSourceRef attribute of the databaseStore element in the OAuth provider is correctly defined. |
Explanation | The OAuth provider has a databaseStore element specified but the attribute is either not specified or is invalid. This might be due to a configuration error. |
Action | Ensure the attribute of the databaseStore element in the OAuth provider is correctly defined. |
Explanation | Each OpenID Connect provider is required to have a unique OAuth provider in the server.xml file. Otherwise, the duplicated OpenID Connect provider is deactivated. |
Action | Make sure that every OpenID Connect provider has a unique OAuth provider in the server.xml file. |
Explanation | The OAuth provider has a databaseStore element specified but the dataSourceFactory for the specified dataSource is not activated. This might be due to a configuration error with the dataSource. |
Action | Ensure the dataSourceRef attribute of the databaseStore element in the OAuth provider is correctly defined to refer to a valid dataSource. |
Explanation | The TokenIntrospectProvider installed in Liberty is returning null or a bad JSON format string for the given user. |
Action | Make sure the TokenIntrospectProvider returns a valid JSON format string. |
Explanation | There are more than one TokenIntrospectProviders configured in the server.xml file. |
Action | No user action required. |
Explanation | Failed to process the request because the access_token is not valid. |
Action | Make sure the access_token is valid and is not expired. |
Explanation | A signing key could not be found or a key that uses the configured signature algorithm could not be found. |
Action | Make sure the signing key and signature algorithm are configured correctly. |
Explanation | The OpenID Connect Provider can not create a token. The reason is displayed in the message. |
Action | See the user action for the error displayed in the message. |
Explanation | An RSA key is required for this signature algorithm. |
Action | Configure a different signature algorithm or specify an RSA key to use for signatures. |
Explanation | The Java version in the message can not support the JWT Mediator SPI function. |
Action | Install Java version 1.7 or higher. |
Explanation | The database cache has a large quantity of expired tokens, which might lead to performance issues with token lookups. By reducing the value of the specified attribute, the cleanup task will run more often and reduce the number of expired tokens that are kept in the database. |
Action | Update the specified attribute of the OAuth Provider configuration by lowering the value. |
Explanation | A connection to the database might not be available, the database table might have columns with incorrect data types, or a database command is malformed. |
Action | Verify that the database connection is still open and available. Ensure that the database tables are configured with the appropriate data types. |
Explanation | A connection to the database might not be available, the database table might have columns with incorrect data types, or a database command is malformed. |
Action | Verify that the database connection is still open and available. Ensure that the database tables are configured with the appropriate data types. |
Explanation | An exception occurred when evaluating the regular expression. |
Action | Correct the regular expression. |
Explanation | The body of the request must contain a client encoded in JSON format. |
Action | Ensure that the request body is not empty and contains a client encoded in JSON format. |
Explanation | The OAuthStore implementation could not perform the operation. Possible configurations issues include missing or incorrect attributes for the OAuthStore implementation specific elements in the server.xml file or other implementation specific configuration file. Possible operational issues include database, networking, or file system errors. |
Action | Verify that the OAuthStore implementation is still available and is configured appropriately. |
Explanation | The OAuthStore implementation could not perform the operation. Possible configurations issues include missing or incorrect attributes for the OAuthStore implementation specific elements in the server.xml file or other implementation specific configuration file. Possible operational issues include database, networking, or file system errors. |
Action | Verify that the OAuthStore implementation is still available and is configured appropriately. |
Explanation | The OAuthStore implementation could not perform the operation. Possible configurations issues include missing or incorrect attributes for the OAuthStore implementation specific elements in the server.xml file or other implementation specific configuration file. Possible operational issues include database, networking, or file system errors. |
Action | Verify that the OAuthStore implementation is still available and is configured appropriately. |
Explanation | The OAuthStore implementation could not perform the operation. Possible configurations issues include missing or incorrect attributes for the OAuthStore implementation specific elements in the server.xml file or other implementation specific configuration file. Possible operational issues include database, networking, or file system errors. |
Action | Verify that the OAuthStore implementation is still available and is configured appropriately. |
Explanation | The OAuthStore implementation could not perform the operation. Possible configurations issues include missing or incorrect attributes for the OAuthStore implementation specific elements in the server.xml file or other implementation specific configuration file. Possible operational issues include database, networking, or file system errors. |
Action | Verify that the OAuthStore implementation is still available and is configured appropriately. |
Explanation | The OAuthStore implementation could not perform the operation. Possible configurations issues include missing or incorrect attributes for the OAuthStore implementation specific elements in the server.xml file or other implementation specific configuration file. Possible operational issues include database, networking, or file system errors. |
Action | Verify that the OAuthStore implementation is still available and is configured appropriately. |
Explanation | The OAuthStore implementation could not perform the operation. Possible configurations issues include missing or incorrect attributes for the OAuthStore implementation specific elements in the server.xml file or other implementation specific configuration file. Possible operational issues include database, networking, or file system errors. |
Action | Verify that the OAuthStore implementation is still available and is configured appropriately. |
Explanation | The OAuthStore implementation could not perform the operation. Possible configurations issues include missing or incorrect attributes for the OAuthStore implementation specific elements in the server.xml file or other implementation specific configuration file. Possible operational issues include database, networking, or file system errors. |
Action | Verify that the OAuthStore implementation is still available and is configured appropriately. |
Explanation | The OAuthStore implementation could not perform the operation. Possible configurations issues include missing or incorrect attributes for the OAuthStore implementation specific elements in the server.xml file or other implementation specific configuration file. Possible operational issues include database, networking, or file system errors. |
Action | Verify that the OAuthStore implementation is still available and is configured appropriately. |
Explanation | The OAuthStore implementation could not perform the operation. Possible configurations issues include missing or incorrect attributes for the OAuthStore implementation specific elements in the server.xml file or other implementation specific configuration file. Possible operational issues include database, networking, or file system errors. |
Action | Verify that the OAuthStore implementation is still available and is configured appropriately. |
Explanation | The OAuthStore implementation could not perform the operation. Possible configurations issues include missing or incorrect attributes for the OAuthStore implementation specific elements in the server.xml file or other implementation specific configuration file. Possible operational issues include database, networking, or file system errors. |
Action | Verify that the OAuthStore implementation is still available and is configured appropriately. |
Explanation | The OAuthStore implementation could not perform the operation. Possible configurations issues include missing or incorrect attributes for the OAuthStore implementation specific elements in the server.xml file or other implementation specific configuration file. Possible operational issues include database, networking, or file system errors. |
Action | Verify that the OAuthStore implementation is still available and is configured appropriately. |
Explanation | The OAuthStore implementation could not perform the operation. Possible configurations issues include missing or incorrect attributes for the OAuthStore implementation specific elements in the server.xml file or other implementation specific configuration file. Possible operational issues include database, networking, or file system errors. |
Action | Verify that the OAuthStore implementation is still available and is configured appropriately. |
Explanation | The OAuthStore implementation could not perform the operation. Possible configurations issues include missing or incorrect attributes for the OAuthStore implementation specific elements in the server.xml file or other implementation specific configuration file. Possible operational issues include database, networking, or file system errors. |
Action | Verify that the OAuthStore implementation is still available and is configured appropriately. |
Explanation | The OAuthStore implementation could not perform the operation. Possible configurations issues include missing or incorrect attributes for the OAuthStore implementation specific elements in the server.xml file or other implementation specific configuration file. Possible operational issues include database, networking, or file system errors. |
Action | Verify that the OAuthStore implementation is still available and is configured appropriately. |
Explanation | The OAuthStore implementation could not perform the operation. Possible configurations issues include missing or incorrect attributes for the OAuthStore implementation specific elements in the server.xml file or other implementation specific configuration file. Possible operational issues include database, networking, or file system errors. |
Action | Verify that the OAuthStore implementation is still available and is configured appropriately. |
Explanation | The OAuthStore implementation could not perform the operation. Possible configurations issues include missing or incorrect attributes for the OAuthStore implementation specific elements in the server.xml file or other implementation specific configuration file. Possible operational issues include database, networking, or file system errors. |
Action | Verify that the OAuthStore implementation is still available and is configured appropriately. |
Explanation | The OAuth provider has a customStore element specified, but the attribute is either not specified or is invalid. This problem might be due to a configuration error. |
Action | Ensure that the attribute of the customStore element in the OAuth provider is correctly defined. |
Explanation | An application password or application token was requested for the application, but one already exists or the requested name is too long. |
Action | Delete the existing application password or application token before requesting a new one for this application, or use a different application name. |
Explanation | Only users in the tokenManager role can supply the user_id attribute for this request URI. |
Action | Issue the request again with the required tokenManager role and a valid user_id. |
Explanation | The indicated request is not valid. A valid client ID and client secret must be supplied in the Authorization header for the request that is sent to the URI. |
Action | Correct the request. Issue the request again with a valid client ID and client secret in the Authorization header. |
Explanation | A valid client ID and client secret must be supplied in the Authorization header for the request that is sent to the URI. |
Action | Issue the request again with a valid client ID and client secret in the Authorization header. |
Explanation | The client is not configured to allow the use of application passwords or application tokens. |
Action | Correct the OpenID Connect provider configuration for the specified client to set the value of the appPasswordAllowed attribute to true. |
Explanation | The request to create a new application password or application token would exceed the configured number of application passwords or application tokens that are allowed per user for a given client and provider. |
Action | Delete application passwords or application tokens, or change the OAuth client configuration userClientTokenLimit attribute to increase the number of application passwords and application tokens that are allowed for each user. |
Explanation | The length of the specified parameter value must be limited to a reasonable length. |
Action | Correct the specified parameter so that its length is less than the specified number of characters, and submit the request again. |
Explanation | A valid access token must be supplied with the specified request URI. |
Action | Issue the request again with a valid access token. |
Explanation | The specified request must include a valid access token. |
Action | Issue the request again with a valid access token. |
Explanation | The specified request must include client authentication information. |
Action | Issue the request again with valid client authentication information in the Authorization header. |
Explanation | The specified request must include an access token for the same client that is provided in the Authorization header. |
Action | Issue the request again with an access token for the client that is provided in the Authorization header. |
Explanation | The specified request must contain credentials in the Authorization header for a configured OAuth client so that the request can be authenticated. |
Action | Ensure that the request uses the Basic authentication scheme to include OAuth client credentials. |
Explanation | The client and provider attributes must be set for the URI to process requests. |
Action | Set the client and provider attributes correctly so the provider can process the request. |
Explanation | The Java version in use is not 8 or higher. |
Action | Install Java version 8 or higher. |
Explanation | The Java version in use is not 8 or higher. |
Action | Install Java version 8 or higher to use the mentioned configuration option. |
Explanation | The token is not valid because its grant type is not allowed. |
Action | Use a token with a grant type that is allowed. |
Explanation | The request cannot be completed because the URI must not contain a fragment. |
Action | Review the property value in the request and remove the URI fragment. |
Explanation | The URI value must use the HTTP or HTTPS scheme. |
Action | Review the property value in the request and update it to use the HTTP or HTTPS scheme. |
Explanation | The OpenID Relying Party Service is activated. |
Action | None. |
Explanation | The OpenID Relying Party Service is deactivated. |
Action | None. |
Explanation | The OpenID relying party configuration has been successfully processed. |
Action | None. |
Explanation | The OpenID relying party configuration has been successfully modified. |
Action | None. |
Explanation | Cannot set maxAssociationAttempts to zero and allowStateless to false. |
Action | Specify a valid OpenID relying party configuration for the maxAssociationAttempts and allowStateless attributes. |
Explanation | This version of the OpenID provider was not tested. Its functions may not work properly. Run it at your own risks. |
Action | None. Run it at your own risks. |
Explanation | OpenID provider does not return a valid result. The causes could be the user failed to authenticate or he/she rejected the authorization. |
Action | None. |
Explanation | The enforceHttps attribute of the OpenID configuration is set to true but sslRef does not exist. |
Action | Ensure the sslRef reference to a valid SSL configuration. |
Explanation | The enforceHttps attribute of OpenID configuration is set to true. But SSL service is not available. |
Action | Ensure that you have the correct SSL information in the server.xml. |
Explanation | The enforceHttps attribute of OpenID configuration is set to true. The keyStore element may be missing or incorrectly specified. The SSL feature may not be enabled. |
Action | Ensure that you have the correct SSL information in the server.xml. |
Explanation | The relying party requires SSL but the openID provider URL protocol is not HTTPs. |
Action | Ensure the openID provider supports SSL. If the openID provider does not support HTTPs, set enforceHttps to false. |
Explanation | Cannot access the OpenID provider. |
Action | Specify a valid OpenID provider. |
Explanation | OpenID replying party request identifier is null. |
Action | None. |
Explanation | OpenID authentication failed for the identifier. |
Action | Ensure the identifier is valid. |
Explanation | There is no cache entry found for unique key. |
Action | Ensure the maxSize of the discovery information cache is big enough to cache all the requests at any given time. |
Explanation | OpenID can not verify the OP response for the claimed identifier. |
Action | Ensure openID relying party can communicate with openID provider. |
Explanation | A request was received that did not include a required cookie. |
Action | Verify the OpenID Connect provider and client configurations. The missing cookie can be caused by accessing the client with a host name that differs from the host name of the redirect that is registered with the provider. If the sameSiteCookie attribute in the webAppSecurity element in the server configuration is set to Strict, try setting the value to Lax or None. |
Explanation | The OpenId Connect client uses the discovery endpoint to contact the provider and uses the information from the discovery request to contact the other endpoints such as authorization and token and userinfo. |
Action | Configure either the discovery endpoint or the other endpoints such as authorization and token and userinfo, not both. |
Explanation | The OpenId Connect client uses the discovery endpoint to contact the provider and uses the information from the discovery request. |
Action | Configure either the discovery endpoint or the issuer identifier not both. |
Explanation | If the OpenID Connect provider does not support RP defaults, depending on the capacity of the RP, the defaults can be adjusted to what OP supports. |
Action | Informational message. No action is required. |
Explanation | The OpenID Connect Client is configured to discover the OpenID Connect Provider endpoints through the discovery URL, but the discovery process failed. The OpenID Connect Client will be unable to process the authentication requests until the configuration of the discoveryEndpointURL is corrected or the discovery is successful. |
Action | Correct the OpenID Connect Client configuration to ensure that 1) the discovery endpoint URL refers to the correct OpenID Connect provider, 2) the discovery endpoint URL is HTTPS and 3) the SSL feature and keystore elements are configured correctly with trust for OpenID Connect Provider. Make sure that the OpenID Connect provider discovery endpoint is functional. |
Explanation | OpenID Connect client failed to access the OpenID Connect provider discovery endpoint and the message may contain more information about the error. |
Action | Ensure that the OpenID Connect provider is available and the specified discovery endpoint is correct. |
Explanation | The OpenID Connect client contacts the discovery endpoint of the OpenID Connect provider to get the information such as authorizationEndpointUrl, tokenEndpointUrl, userInfoEndpointUrl, jwkEndpointUrl. This information enables the OpenID Connect client to interact with the OpenID Connect provider to send authorization, token, jwk, userinfo requests. |
Action | Informational message. No action is required. |
Explanation | The OpenID Connect client contacts the discovery endpoint of the OpenID Connect provider, 1)if there is a problem contacting the authorization or token endpoints of the OpenID Connect provider 2)if the current time is later than the next discovery time. Next discovery time is calculated by adding the discoveryPollingRate value to the current time after each discovery call. |
Action | Informational message. No action is required. |
Explanation | The OpenID Connect client contacts the discovery endpoint of the OpenID Connect provider, 1)if there is a problem contacting the authorization or token endpoints of the OpenID Connect provider 2)if the current time is later than the next discovery time. Next discovery time is calculated by adding the discoveryPollingRate value to the current time after each discovery call. If the latest discovery information matches the previous one, then no configuration update takes place. |
Action | Informational message. No action is required. |
Explanation | The specified configuration attribute might be missing from the server configuration. If a value is specified, white space at the beginning and end of the value is removed when the value is processed, so the value in the configuration might be empty or consist of only white space characters. If the discovery endpoint is specified to get this attribute value from the provider, then the discovery might have a problem. |
Action | Ensure that the specified configuration attribute is configured, that it is not empty, and that it does not consist of only white space characters. If the discovery endpoint is configured to obtain this information, then make sure that there are no errors with the discovery request. |
Explanation | More than one OpenID Connect client configuration contains an authFilterRef attribute that refers to the same filter. Any of these clients might process a request that matches the filter, leading to indeterminate behavior. |
Action | Review the server.xml file and correct the configuration. |
Explanation | More than one authentication filter matches an inbound request. Any client that uses one of these filters could process the request, leading to indeterminate behavior. |
Action | Review the server.xml file and correct the configuration. |
Explanation | A request was received that includes a malformed cookie. |
Action | Verify the OpenID Connect provider and client configurations. The malformed cookie can be caused by cookie modification at the user agent with a host name that differs from the host name of the redirect that is registered with the provider. If the host name is expected, then add it to the wasReqURLRedirectDomainNames attribute of the webAppSecurity element in server.xml. |
Explanation | The web response must be a JWT in either JSON Web Encryption (JWE) or JSON Web Signature (JWS) format. The response might be malformed, or the OpenID Connect client encountered another error processing the response. |
Action | See the error in the message for more information. Verify that the response is in JWT format. |
Explanation | An authorization endpoint URL must be set to obtain an authorization code or the required tokens. |
Action | Set the authorizationEndpointUrl attribute in the OpenID Connect client configuration to the authorization endpoint URL of the OpenID Connect provider. Alternatively, set the discoveryEndpointUrl attribute in the OpenID Connect client configuration to the discovery endpoint URL of the OpenID Connect provider. |
Explanation | A token endpoint URL must be set to obtain the required tokens. |
Action | Set the tokenEndpointUrl attribute in the OpenID Connect client configuration to the token endpoint URL of the OpenID Connect provider. Alternatively, set the discoveryEndpointUrl attribute in the OpenID Connect client configuration to the discovery endpoint URL of the OpenID Connect provider. |
Explanation | The token might be malformed or might be in JSON Web Encryption (JWE) format. Tokens must be in JWS format if the keyManagementKeyAlias attribute is not configured. |
Action | To accept JWE tokens, configure the keyManagementKeyAlias attribute in the OpenID Connect client configuration. Otherwise, ensure that only JWS tokens are sent to this resource. |
Explanation | The token might be malformed or might be in JSON Web Signature (JWS) format. Tokens must be in JWE format if the keyManagementKeyAlias attribute is configured. |
Action | To accept JWS tokens instead of JWE tokens, remove the keyManagementKeyAlias attribute in the OpenID Connect client configuration. Otherwise, ensure that only JWE tokens are sent to this resource. |
Explanation | The UserInfo endpoint should return claims as members of a JSON object or a JSON Web Token (JWT). The format of the response might not be valid, or the response might not match the format that is specified by the Content-Type header. |
Action | Check the format of the UserInfo endpoint response to ensure it is in JSON or JWT format. |
Explanation | The Content-Type header in the web response indicates that the response contains a JWT, but the response body is not in a valid JWT format. |
Action | Ensure that the web response is in the format that is expected by the OpenID Connect client. |
Explanation | The response from the UserInfo endpoint might not be in a format that is expected. The OpenID Connect client might have encountered an error while submitting the UserInfo request. |
Action | Check the error message for more information. Verify that the content of the UserInfo response matches the Content-Type HTTP header. |
Explanation | The request does not use the HTTP POST method, the request is missing a logout token or the logout token cannot be validated, or the logout request did not complete successfully. |
Action | Verify that the HTTP POST method is used to submit the back-channel logout request. Otherwise, see the user action for the error that is included in this message. |
Explanation | The back-channel logout request must include a logout_token parameter whose value is a valid logout token. |
Action | Update the request to include a logout token. |
Explanation | The logout token might be malformed, the token might be in an unexpected format, or another error occurred validating the signature or claims of the token. |
Action | See the user action for the error that is included in this message. |
Explanation | The OpenID Connect feature expects the back-channel request URI to include an OpenID Connect client ID to determine which client to log out. |
Action | Verify that the request URI includes the OpenID Connect client ID to use for logging out the user. |
Explanation | The logout token must contain the claims that are specified in the message. |
Action | Ensure that the OpenID Connect provider includes the missing claims in the logout token. |
Explanation | The "sub" and "sid" claims identify the user and session that is associated with a token. At least one of those claims must be present to determine the user or session to log out. |
Action | Ensure that the OpenID Connect provider includes the missing claims in the logout token. |
Explanation | The "events" claim in the logout token must be a JSON object. |
Action | Ensure that the OpenID Connect provider uses the correct data type for the "events" claim. |
Explanation | The "events" claim must be a JSON object that contains a member with the name that is specified in the message. |
Action | Ensure that the "events" claim includes the required member. |
Explanation | A logout token must not contain a "nonce" claim so that the token cannot be used in a forged authentication response in place of an ID token. |
Action | Ensure that the logout token does not contain a "nonce" claim. |
Explanation | The corresponding member value must be a JSON object. The expected value is "{}", an empty JSON object. |
Action | Ensure that the "events" claim in the logout token is formatted correctly. |
Explanation | The "jti" claim uniquely identifies a logout token. Another logout token with this "jti" was used, so the token cannot be used again. |
Action | Ensure the logout token contains a unique "jti" value and that logout tokens are not used multiple times. |
Explanation | The OpenID Connect client does not have a recent session with an OpenID Connect provider that matches all of the claims that are specified in the message. The claims that are specified in the message must have values in the logout token that match the same claims of an ID token that was received recently. |
Action | Ensure that claims that are specified in the message match an ID token that was recently obtained from an OpenID Connect provider. |
Explanation | The OpenID Connect client configuration might be missing information, or the client encountered an error while communicating with the OpenID Connect provider. |
Action | See the error in the message for more information. |
Explanation | The request includes a malformed cookie. The hostname in the cookie must match the current request or must match one of the allowed domain names. The cookie might be modified from within the user agent. |
Action | Verify the OpenID Connect provider and client configurations. If the hostname is expected, add it to the wasReqURLRedirectDomainNames attribute of the webAppSecurity element in the server configuration. |
Explanation | The specified response status indicated that the authentication was not successful. The error and error description that are provided in the message contain additional information. |
Action | For more information, see the error in the message. |
Explanation | The OpenID Connect provider configuration has been successfully processed. |
Action | None |
Explanation | The OpenID Connect provider configuration has been successfully modified. |
Action | None. |
Explanation | The OpenID Connect provider property value being requested expected one value, but returned more. |
Action | Inspect the OpenID Connect provider property in the server.xml file to ensure only one value is configured. |
Explanation | The OpenID Connect provider property value being requested expected at least one value, but returned none. |
Action | Inspect the OpenID Connect provider property in the server.xml file to ensure at least one value is configured. |
Explanation | The OpenID Connect provider property value being requested expected a boolean value of 'true' or 'false'. |
Action | Inspect the OpenID Connect provider property in the server.xml file to ensure a boolean value of 'true' or 'false' is configured. |
Explanation | Specified grant type is not valid. |
Action | Specify one of the available grant types. |
Explanation | Specified grant type is valid but the OpenID Connect provider cannot handle it. |
Action | Specify one of the allowed grant types. |
Explanation | Specified response type is not valid. |
Action | The Authorization request should be modified to include one of the valid response types. |
Explanation | The Authorization request should have only one response type. |
Action | The Authorization request should be modified to include one response type only. |
Explanation | The OpenID Connect request with response type id_token requires openid in its scopes list. |
Action | Make sure that the openid scope is included in the request. |
Explanation | The Nonce value is required for OpenID Connect requests using the implicit flow. |
Action | Supply the Nonce value with implicit OpenID Connect requests. |
Explanation | The JWT token does not have all the required claims in the Payload. |
Action | Supply the required claims in the Payload of JWT token. |
Explanation | The required claim in the payload of JWT token is not valid. |
Action | Supply a good claim in the payload of JWT token. |
Explanation | The claim in the payload of JWT token is not valid. |
Action | Supply a good claim in the payload of JWT token. |
Explanation | The JWT token provider configuration has defined 'maxJwtLifetimeMinutesAllowed', the incoming jwt token is required to provide 'iat' claim. |
Action | Remove 'maxJwtLifetimeMinutesAllowed' from configuration or supply the 'iat' claim in the Payload of JWT token. |
Explanation | A JWT token with the same 'iss' and 'jti' claims had been requested already. It indicates a potential replay attack. |
Action | Make sure the JWT Token issuer providing each JWT Token with an unique 'jti' claim. |
Explanation | A userinfo request was made with no access token, an access token is required. |
Action | Provide an access token with either the access_token request parameter or the authorization header. |
Explanation | A userinfo request was made with an access token that was not recognized. A valid access token is required. |
Action | Provide a valid access token with either the access_token request parameter or the authorization header. |
Explanation | A userinfo request URI was not valid, a valid URI is required. |
Action | Provide a valid userinfo request URI. |
Explanation | A userinfo request was made with an access token that did not have the 'openid' scope. |
Action | Provide an access token that was created with the 'openid' scope. |
Explanation | An internal server error occurred while processing a userinfo request. |
Action | Contact IBM support. |
Explanation | An internal server error occurred while processing a userinfo request. |
Action | Contact IBM support. |
Explanation | A userinfo request was made with an access token in the access_token request parameter and also the authorization header. Only one access token is allowed. |
Action | Provide an access token with either the access_token request parameter or the authorization header, but not both. |
Explanation | A userinfo request was made with a token that was not an access token. A valid access token is required. |
Action | Provide a valid access token with either the access_token request parameter or the authorization header. |
Explanation | A userinfo request was made with an expired access token. A valid access token is required. |
Action | Provide a valid access token with either the access_token request parameter or the authorization header. |
Explanation | A userinfo request URI was not valid. The provider contained in the URI was not found. A valid URI is required. |
Action | Provide a valid userinfo request URI that contains a valid provider name. |
Explanation | The OpenID Connect provider cannot validate the ID token. This might have been caused by an inconsistency in signing keys between the creator of the ID token and this provider. |
Action | Ensure that the OpenID Connect client (RP) sends the ID token which was generated by this provider. Also see the user action for the error that appears after this error. |
Explanation | The OpenID Connect provider detects that the current login user identity is not consistent with the user information in the ID token. This might have been caused by an end user switching login users. |
Action | Ensure that the end user does not switch the user identity of the OpenID Connect provider. |
Explanation | An internal server error occurred while processing a userinfo request. The federated repository service was not available. |
Action | Contact IBM support. |
Explanation | No OpenID Connect endpoint service is available through the OSGi service registry. |
Action | Include the openidConnectServer-1.0 feature in your server configuration. |
Explanation | The OpenID Connect configuration service is not available for the provider. |
Action | Inspect the OpenID Connect provider property in the server.xml file to ensure at least one provider is specified. |
Explanation | The OpenID Connect provider has no OAuthProvider |
Action | Inspect the OpenID Connect provider property in the server.xml file to ensure at least one OAuth provider is specified. |
Explanation | The OpenID Connect endpoint service is activated. |
Action | None |
Explanation | The OpenID Connect provider does not have an OAuth provider name, or an OAuth provider with the given name does not exist. |
Action | Specify a valid OAuth provider name for the OpenID Connect provider. |
Explanation | A userinfo request was made with an unsupported parameter. |
Action | Invoke the userinfo endpoint without the unsupported parameter. |
Explanation | The attribute is missing from the request |
Action | Inspect the request endpoint in the server.xml file to ensure you have the right provider |
Explanation | The issuerIdentifier is set incorrectly. |
Action | Modify the OpenIDConnect provider attribute, issuerIdentifier, to use the https scheme. |
Explanation | The post_logout_redirect_uri parameter which the OpenID Connect client (RP) sends is not on the list of URIs which is specified by postLogoutRedirectUris attribute, or the value of postLogoutRedirectUris is not set. |
Action | Make sure that the value of the post_logout_redirect_uri parameter is in the list of the postLogoutRedirectUris attribute that exists in the registered client. Also, if the client ID is null, or the id_token_hint parameter is not valid or not set, then the id_token_hint parameter is required in order to identify the client ID. |
Explanation | The UserinfoProvider installed in Liberty is returning null for the given user. |
Action | Make sure the UserinfoProvider returns a valid JSONObject. |
Explanation | There are more than one UserinfoProvider configured in the server.xml file. |
Action | None |
Explanation | The UserinfoProvider installed in Liberty is returning an invalid JSONObject for the given user. |
Action | Make sure the UserinfoProvider returns a valid JSONObject. |
Explanation | Producing a JWK JSON string requires the OpenID Connect provider signatureAlgorithm attribute to be set to RS256. Attributes KeyStoreRef and keyAliasName must be valid if specified. |
Action | Correct the OpenID Connect provider configuration attributes. |
Explanation | The claims from the third-party ID token cannot be extracted. View the error message for more information. |
Action | Ensure that the third-party OpenID Connect provider is sending a valid ID token. |
Explanation | The ID token string in the id_token_hint parameter, if one was provided, might be malformed. The provider might not be able to determine the set of clients to send back-channel logout requests. If the id_token_hint parameter is not malformed, another error occurred when the provider tried to build a logout token. |
Action | See the user action for the error that is included in the message. |
Explanation | The ID token might be malformed or a claim within the token might have a value that is an unexpected data type. Alternatively, the token might be missing claims that are required or the issuer of the token is not the issuer that is expected. |
Action | Ensure the ID token is formatted correctly. See the error that is included in the message for more information. |
Explanation | The OAuth client does not exist, or another error occurred. |
Action | For more information, see the error included in the message. |
Explanation | The Java version in the message can not support the ID token Mediator SPI function. |
Action | Install Java version 1.7 or higher. |
Explanation | The OpenID Connect provider did not issue the ID token, so the token cannot be handled by this OpenID Connect provider. |
Action | Send only ID tokens with an issuer claim that matches the configuration for the OpenID Connect provider that is specified in the message. |
Explanation | The OpenID Connect specification requires that the claim or claims that are listed in the error message must be present in the ID token. |
Action | Ensure that the ID token contains all of the required claims. |
Explanation | The OpenID Connect client did not return a successful status code for the back-channel logout request. If the status code is 400, the logout request was not valid. If the status code is 501, logout at the OpenID Connect client failed. If the status code is 504, local logout at the OpenID Connect client succeeded but some downstream logout attempts failed. |
Action | Send another logout request to retry the back-channel logout. For more information, see the error included in the message. |
Explanation | The back-channel logout request either timed out, threw an exception, was cancelled, or was interrupted. |
Action | Ensure that the back-channel logout URI is responsive. Update the backchannelLogoutRequestTimeout configuration attribute in the OpenID Connect provider if the back-channel logout request needs more time. For more information, see the error included in the message. |
Explanation | The JASPIC AuthConfigProvider class is now available to authenticate inbound web requests. |
Action | No action is required. |
Explanation | The JASPIC AuthConfigProvider class is no longer available to authenticate inbound web requests. |
Action | No action is required. |
Explanation | Authentication for the web request was failed by the user defined Java Authentication SPI for Containers (JASPIC) provider with the given class name. |
Action | Verify that the web request had valid authentication data for the user defined JASPIC provider. Look for any messages issued by the JASPIC provider and consult with your system administrator regarding the JASPIC provider authentication data requirements. |
Explanation | The user defined feature implementing a JASPIC provider service with the given class name is now available to authenticate inbound web requests. |
Action | No action is required. |
Explanation | The user defined feature implementing a JASPIC provider service with the given class name is no longer available to authenticate inbound web requests. |
Action | No action is required. |
Explanation | The default JASPIC AuthConfigFactory class is being used because the Java security property authconfigprovider.factory is not set. |
Action | No action is required. |
Explanation | The class specified by the Java security property authconfigprovider.factory is being used as the JASPIC AuthConfigFactory class. |
Action | No action is required. |
Explanation | The OpenID Connect client (relying party or resource server) configuration has been successfully processed. |
Action | None |
Explanation | The OpenID Connect client (relying party or resource server) configuration has been successfully modified. |
Action | None. |
Explanation | The OpenID Connect client (relying party or RP) encountered an error when processing a request. The error was most likely an encoding error. The reason for the error is shown after the message. |
Action | Retry the request with different OpenID Connect client configuration attributes such as client id, scope. See the user action for the error that appears after this error. |
Explanation | The OpenID Connect client (relying party or resource server) requires SSL (HTTPS) but the OpenID Connect provider (OP) URL protocol specified in the OpenID Connect client configuration is not HTTPS. |
Action | Do one of the following: First, ensure that the OpenID Connect provider supports SSL. If the OpenID Connector provider does not support SSL, use the OpenID Connect Client feature and set enforceHTTPS to false in the OpenID Connect Client feature configuration. |
Explanation | The OpenID Connect client (relying party or resource server) requires SSL (HTTPS) but the OpenID Connect provider (OP) URL protocol specified in the OpenID Connect client configuration is not HTTPS. |
Action | Do one of the following: First, ensure that the OpenID Connect provider supports SSL. If the OpenID Connector provider does not support SSL, use the OpenID Connect Client feature and set enforceHTTPS to false in the OpenID Connect Client feature configuration. |
Explanation | The OpenID Connect client (relying party or RP) has sent a request to an OpenID Connect provider (OP) and the OP has sent back a response with a state parameter does not match the state of the RP at the time it was sent. The OP must include in the response the same state as was sent. The state is used in this manner to prevent cross-site request forgery. |
Action | Ensure that your OP URL is correct. Check the logs on your OP to ensure that it has received the request. |
Explanation | The OpenID Connect client (relying party or RP) has sent a request to an OpenID Connect provider (OP) and the OP has sent back a response with a state parameter does not match the state of the RP at the time it was sent. The OP must include in the response the same state as was sent. The state is used in this manner to prevent cross-site request forgery. |
Action | Ensure that your OP URL is correct. Check the logs on your OP to ensure that it has received the request. |
Explanation | In order to authenticate an ID token, the OpenID Connect client (relying party or RP) must have a subject identifier. The ID token received in the response from OpenID Connect provider (OP) did not contain a subject identifier, so authentication failed. |
Action | Ensure that the OpenID Connect provider (OP) returns an ID token that includes a subject identifier. |
Explanation | In order to authenticate an ID token, the OpenID Connect client (relying party or RP) must have a subject identifier. The ID token received in the response from OpenID Connect provider (OP) did not contain a subject identifier, so authentication failed. |
Action | Ensure that the OpenID Connect provider (OP) returns an ID token that includes a subject identifier. |
Explanation | The OpenID Connect client (relying party or RP) cannot validate the ID token successfully. This might have been caused by a failure in the process of required claims validation. Some of the ID token required claims include issuer, audience, issued time. |
Action | Ensure that OpenID Connect client (RP) system clock is in sync with OpenID Connect provider (OP) system clock (in case they are on two different systems). Also see the user action for the error that appears after this error. |
Explanation | The OpenID Connect client (relying party or RP) cannot validate the ID token successfully. This might have been caused by a failure in the process of required claims validation. Some of the ID token required claims include issuer, audience, issued time. |
Action | Ensure that OpenID Connect client (RP) system clock is in sync with OpenID Connect provider (OP) system clock (in case they are on two different systems). Also see the user action for the error that appears after this error. |
Explanation | The OpenID Connect client (relying party or resource server) configuration is configured to use the HTTPS scheme, but an HTTPS connection could not be established. The SSL feature may not be enabled. The keyStore element may be missing or incorrectly specified. |
Action | Ensure that you have the correct SSL information in the server.xml. See the user action for the error that appears before this message. |
Explanation | The OpenID Connect client (relying party or resource server) configuration is configured to use the HTTPS scheme, but an HTTPS connection could not be established. The SSL feature may not be enabled. The keyStore element may be missing or incorrectly specified. |
Action | Ensure that you have the correct SSL information in the server.xml. See the user action for the error that appears before this message. |
Explanation | The OpenID Connect client (relying party or RP) failed to obtain an ID token from the OpenID Connect provider (OP) because a connection could not be established with the provider. The OP might not have been available at the time of the request, the request might not have been directed to a valid endpoint, or there might be some configuration mismatch between the OP and the RP. The reason for the error appears after the message. |
Action | Check the server configuration to make sure the configured token endpoint URL is a valid URL and points to the token endpoint of an active OpenID Connect provider. See the actions for the error displayed after this message. |
Explanation | The OpenID Connect client (relying party or resource server) received a response from the OpenID Connect provider (OP), but an error occurred while the relying party or the resource server was processing the response. The reason for the error appears after the message. |
Action | See the actions for the error displayed after this message. |
Explanation | The user has either denied the OpenID Connect request by canceling the request on the scope consent form, or some other error has occurred that has denied access to the OpenID Connect request. |
Action | The user must allow the OpenID Connect provider to share the scopes that the client requires in order for the OpenID Connect request to succeed. If the user approved the request, check the logs on the OP for any additional errors. |
Explanation | The user has either denied the OpenID Connect request by canceling the request on the scope consent form, or some other error has occurred that has denied access to the OpenID Connect request. |
Action | The user must allow the OpenID Connect provider to share the scopes that the client requires in order for the OpenID Connect request to succeed. If the user approved the request, check the logs on the OP for any additional errors. |
Explanation | The user has either denied the OpenID Connect request by canceling the request on the scope consent form, or some other error has occurred that has denied access to the OpenID Connect request. |
Action | The user must allow the OpenID Connect provider to share the scopes that the client requires in order for the OpenID Connect request to succeed. If the user approved the request, check the logs on the OP for any additional errors. |
Explanation | The OpenID Connect client (relying party or RP) failed to obtain an ID token from the OpenID Connect provider (OP). The OP might not have been available at the time of the request, the request might not have been directed to a valid endpoint, or there might be some configuration mismatch between the OP and the RP. |
Action | Check the server configuration to make sure the configured token endpoint URL is a valid URL and points to the token endpoint of an active OpenID Connect provider. Also see the actions for the errors displayed before this message. |
Explanation | The OpenID Connect client requests require an [openid] scope to be set and if the OpenID Connect client configuration is missing this scope, then the requests will fail. |
Action | Make sure to have the required scope [openid] specified in the OpenID Connect client configuration. |
Explanation | OpenID Connect client requests require the nonce to be handled properly during the request flow to mitigate replay attacks. The nonce that is included in the token does not match the nonce that is associated with this request, therefore the request is not valid. |
Action | Ensure that the OpenID Connect provider generates tokens using the nonce that is specified in the initial OpenID Connect client request. |
Explanation | The specified OSGi service is not available. |
Action | Restart the server with the "clean" option. |
Explanation | The access token has expired and the runtime cannot continue with the propagation of the access token. |
Action | Make sure to provide a valid access token, and also make sure to synchronize the time between the systems. |
Explanation | The issue at claim time in the access token is after the current time. This is not allowed. |
Action | Make sure that the access token is not issued for a future time and/or synchronize the time between the systems. |
Explanation | The access token does not have all the required claims. |
Action | Make sure that the provided access token has the required claim. |
Explanation | The not before time claim in the access token is after the current time and the runtime cannot use the access token at present. |
Action | Make sure that the access token does not have a "nbf" claim set to a future time and/or synchronize the time between the systems or resubmit the request at a later time. |
Explanation | The provided access token is not active and the runtime cannot continue with the authentication process. |
Action | Make sure that the provided access token is valid and if possible check the OpenID Connector provider (OP) logs for more details. Also, make sure that the specified validation method and the endpoint url in the OpenID Connect client configuration are correct. |
Explanation | The provided access token cannot be validated due to the error response from the OpenID Connect provider. |
Action | Make sure that the propagation token is valid and if possible, check the logs on the OpenID Connect provider for more details on the error. |
Explanation | The provided access token does not contain the specified claim and the runtime cannot continue with the authentication process. |
Action | Do one of the following. 1)Verify that the OpenID Connect client configuration specifies the correct claim name 2)Verify that the OpenID Connect provider (OP) emits the access token with the specified claim. |
Explanation | The provided access token cannot be verified due to the invalid_client error from the OpenID Connect provider and the runtime cannot continue with the authentication process. |
Action | Verify that the OpenID Connect client configuration has the client id that matches with the client id in the OpenID Connect provider configuration and if possible, check the logs on the OpenID Connect provider for more information. |
Explanation | The provided access token cannot be verified because the "iss" claim in the access token does not match the issuerIdentifier configuration attribute, and the runtime cannot continue with the authentication process. |
Action | Verify that the OpenID Connect client configuration has the issuerIdentifier that contains the "iss" claim in the access token. |
Explanation | The provided access token cannot be validated because the validationEndpointUrl specified in the OpenID Connect client configuration is invalid and the runtime cannot continue with the authentication process. |
Action | Make sure to specify a valid value for the validationEndpointUrl attribute in the OpenID Connect client configuration. |
Explanation | The request must contain a required propagation token, such as: an access token or jwt token, so the resource server can process the authentication and propagation of the token. |
Action | Make sure that the request has a valid propagation token. |
Explanation | The provided access token cannot be validated due to an internal error and the runtime cannot continue with the authentication process. |
Action | Check the resource server logs to see if there are any other errors logged prior to this. |
Explanation | The validationEndpointUrl specified in the OpenID Connect client configuration is not the appropriate endpoint for the specified validationMethod. |
Action | Update the OpenID Connect client configuration by either changing the validationMethod or the validationEndpointUrl. |
Explanation | The validationEndpointUrl specified in the OpenID Connect client configuration is not the appropriate endpoint for the specified validationMethod. |
Action | Update the OpenID Connect client configuration by either changing the validationMethod or the validationEndpointUrl. |
Explanation | The provided access token has an invalid claim data type and the runtime cannot continue with the authentication process. |
Action | Verify that the OpenID Connect client configuration specifies the correct claim name for the attribute. |
Explanation | The provided access token does not contain the specified claim to identify the realm and the runtime cannot continue with the authentication process. |
Action | Do one of the following. 1)Verify that the OpenID Connect client configuration specifies the realmName attribute 2)Verify that the OpenID Connect provider (OP) emits the access token with the specified claim 3)Verify whether the OP can emit the access token with the "iss" claim. |
Explanation | The provided access token does not contain the specified claim to identify the realm and the runtime cannot continue with the authentication process. |
Action | Do one of the following. 1)Verify that the OpenID Connect client configuration specifies the realmName attribute 2)Verify that the OpenID Connect provider (OP) emits the access token with the specified claim 3)Verify whether the OP can emit the access token with the "iss" claim. |
Explanation | The indicated OpenID Connect client has set inboundPropagation to "required" but the configured validationEndpointUrl was not valid. The validationEndpointUrl must be set to a valid URI using the http or https URI scheme. The OpenID Connect client acting as a resource server will not be able to process any requests. |
Action | Make sure the OpenID Connect client configuration has specified a non-empty validationEndpointUrl that uses the http or https URI scheme. |
Explanation | The validationEndpointUrl specified in the indicated OpenID Connect client configuration was not valid. A proper validationEndpointUrl is required to support inbound propagation. The validationEndpointUrl value must be non-empty and must use the http or https URI scheme. The OpenID Connect client will behave as if its inboundPropagation were "none". |
Action | Make sure the OpenID Connect client configuration has specified a non-empty validationEndpointUrl that uses the http or https URI scheme. |
Explanation | The specified configuration attribute defines the ID token claim to use when creating a user subject. The specified claim could not be found in the ID token, so the ID token could not be authenticated and a user subject could not be created. |
Action | Configure the specified attribute to refer to a claim that exists in the ID token and can be used to create a subject. |
Explanation | Since the OpenID Connect client configuration specifies "disableIssChecking", the resource server expects the json response from the validation end point to not have the "iss" claim. |
Action | Do one of the following. 1)Update the OpenID Connect client configuration and set the "disableIssChecking" to "false" 2) Make the validation end point to not emit the "iss" claim. |
Explanation | Since the OpenID Connect client configuration specifies "disableIssChecking", the resource server expects the json response from the validation end point to not have the "iss" claim. |
Action | Do one of the following. 1)Update the OpenID Connect client configuration and set the "disableIssChecking" to "false" 2) Make the validation end point to not emit the "iss" claim. |
Explanation | The open source libraries for processing JSON Web Tokens does not support the Java version that the Liberty server is currently using. |
Action | Install a Java version that is at or higher than the Java level shown in the message. |
Explanation | The open source libraries for processing JSON Web Tokens does not support the Java version that the Liberty server is currently using. |
Action | Install a Java version that is at or higher than the Java level shown in the message. |
Explanation | The OpenID Connect client (relying party or RP) can not validate the JSON Web Token. This might have been caused by a failure while validating required claims. Some of the JSON Web Token required claims include issuer, audience, and issued time. |
Action | See the user action for the error that appears in the message. |
Explanation | The specified configuration attribute defines the JSON Web Token claim to use when creating a user subject. The specified claim could not be found in the JSON Web Token, so the JSON Web Token could not be authenticated and a user subject could not be created. |
Action | Do one of the following actions: 1) Change your configuration of the specified attribute to refer to a claim that exists in the JSON Web Token. 2) Modify the JSON Web Token to include the specified attribute. |
Explanation | A signing key could not be found, or a key that uses the configured signature algorithm could not be found. This could be due to missing, malformed, or inaccurate information in the client configuration or token. |
Action | Do one of the following actions: 1) If using JWK to sign and validate tokens, ensure the jwkEndpointUrl attribute is configured properly and the JWT and JWK claims are correct. 2) If using X.509 certificates to sign and validate tokens, ensure the signatureAlgorithm, trustStoreRef, and trustStoreAlias attributes are configured properly. 3) If using shared keys to sign and validate tokens, ensure the clientId and clientSecret attributes are configured properly. |
Explanation | A signing key could not be found, or a key that uses the configured signature algorithm could not be found. This could be due to missing, malformed, or inaccurate information in the client configuration or token. |
Action | Do one of the following actions: 1) If using JWK to sign and validate tokens, ensure the jwkEndpointUrl attribute is configured properly and the JWT and JWK claims are correct. 2) If using X.509 certificates to sign and validate tokens, ensure the signatureAlgorithm, trustStoreRef, and trustStoreAlias attributes are configured properly. 3) If using shared keys to sign and validate tokens, ensure the clientId and clientSecret attributes are configured properly. |
Explanation | The token can not be verified for the inbound propagation request. This client will continue to attempt authentication using OpenID Connect. |
Action | If the failure is expected, then no action is required. Otherwise, make sure the inbound propagation environment is properly set up. |
Explanation | Since the signatureAlgorithm is set to "none", a non-signed token is expected, which is not a common use case. |
Action | If inbound tokens are not expected to be signed, then no action is required. Otherwise, select a supported signatureAlgorithm such as RS256 or HS256. |
Explanation | A JWT with "iss" and "jti" claims cannot be used more than once. The jti claim represents a unique identifier for a token and cannot be the same as another token with the same issuer. |
Action | Make sure each JWT token that is issued by the same issuer has a unique jti value. |
Explanation | The OpenID Connect client (relying party or RP) has received a response from an OpenID Connect provider (OP), but the state parameter in the response is not valid. It is either expired or has already been used. |
Action | Make sure the clocks on all systems are synchronized to ensure that state values do not expire prematurely. Make sure that state values are used only once. |
Explanation | The OpenID Connect client (relying party or RP) received a WASOidcCode cookie that is not valid. Its value might have been modified. |
Action | Verify that the cookie has not been modified and that the decoded content of the cookie begins with a properly formatted JSON object. |
Explanation | The OpenID Connect client (relying party or RP) received a WASOidcCode cookie that is not valid. Its value might have been modified. |
Action | Verify that the cookie has not been modified and that the decoded content of the cookie begins with a properly formatted JSON object. |
Explanation | The format of the response was not valid and could not be processed. |
Action | Check the format of the response and contact the partner that sent the message. |
Explanation | A JSON Web Key cannot be returned from the specified URL. The URL might not be valid, the URL might not be configured to return a JWK, the response from the URL might be empty, or an unknown error occurred. |
Action | Verify that the URL is formatted correctly and specifies a location that is capable of returning JSON Web Keys. Check the status code and content of the response for more information. |
Explanation | A request was received that did not match an expected URL or did not contain the required parameters. |
Action | Verify the OpenID Connect provider configuration. This message can also be caused by snooping with a browser. |
Explanation | User Info data could not be obtained from the specified URL. The URL might not be valid, the supplied access token might not be valid, the response from the URL might be empty, or an unknown error occurred. |
Action | Verify that the URL is formatted correctly and specifies a location that is capable of returning User Info data. Check the status code and content of the response for more information. |
Explanation | A request was received that did not include a required state parameter. |
Action | Verify the OpenID Connect provider configuration. This message can also be caused by snooping with a browser. |
Explanation | The sub claim of user info data is required to match the sub claim of the ID token, but it does not. |
Action | Ensure that the OpenID Connect provider generates valid User Info data. |
Explanation | ID token validation failed because the issuer specified in the OpenID Connect client (relying party or RP) or social login client configuration and the issuer in the token do not match. |
Action | Make sure that the [issuerIdentifier] attribute specified in the OpenID Connect client (RP) or social login client configuration matches with the issuer for the OpenID Connect provider (OP) being used. |
Explanation | An ID token cannot be created because it could not be signed. The reason for the error is shown after the message. |
Action | See the user action for the message that appears after this error. |
Explanation | An ID token cannot be created because it could not be signed. The reason for the error is shown after the message. |
Action | If using asymmetric signature, check that a valid private key is used to sign the token. For example, check whether a key is expired. Check the keyStore element referenced by the default SSL in server.xml to find information about the key store file that contains the private key. Also, see the user action for the message that appears after this error. |
Explanation | The audience in the ID token should match the client id. In this case, the (aud) audience in the ID token did not match the client id, so the ID token validation failed. |
Action | Make sure that [clientId] attribute specified in OpenID Connect client (relying party or RP) configuration is correct. The value is case sensitive. |
Explanation | The authorized party in the ID token should match the client id. In this case, the (azp) authorized party in the ID token did not match the client id, so the ID token validation failed. |
Action | Make sure that the [clientId] attribute specified in the OpenID Connect client (relying party or RP) configuration is correct. The value is case sensitive. |
Explanation | An ID token cannot be validated because the signature could not be verified. This might have been caused by a mismatch in the signature algorithm or shared key between the OpenID Connect client and OpenID Connect provider. |
Action | Check the server configuration to make sure the configured signature algorithm and the configured shared key is compatible with that of the OpenID Connect provider. |
Explanation | An ID token cannot be validated because the signature could not be verified. The reason for the error is shown after the message. |
Action | If using asymmetric signature, ensure that the public key in the certificate can be used for digital signature purposes. Check the keyStore element referenced by the default SSL configuration in server.xml to find information about the key store that contains the key. Also, see the user action for the message that appears after this error. |
Explanation | An ID token cannot be validated because the current time shown is not between the token issue and expiration times. |
Action | Make sure that OpenID Connect client (relying party or RP) and OpenID Connect provider (OP) system clocks are in sync (if they are on two systems). |
Explanation | The at_hash in the ID Token enables OpenID Connect clients to prevent token substitution attacks. The at_hash value should match with the value of the hash of the access token received by the OpenID Connect client. |
Action | Ensure that the communication between the OpenID Connect client (relying party or RP) and OpenID Connect provider (OP) is safe to avoid tampering of the access token received by the RP. |
Explanation | An ID token cannot be validated because the token was not signed. OpenID Connect client (relying party or RP) is expecting a signed token. |
Action | Ensure that the OpenID Connect provider enables the token to be signed. |
Explanation | An ID token cannot be validated because OpenID Connect client (relying party or RP) and OpenID Connect provider (OP) are using different signature algorithms to sign/verify the token. |
Action | Ensure that the RP specified signatureAlgorithm matches the OP signature algorithm. |
Explanation | A JWT token cannot be created because it could not be signed. The reason for the error is shown in the message. |
Action | If using an asymmetric signature, check that a valid private key is used to sign the token. For example, check whether a key is expired. Check the keyStore element referenced by the default SSL configuration in the server.xml file to find information about the key store file that contains the private key. Also, see the user action for the message that appears after this error. |
Explanation | A JWT token is not valid because the signature verification failed. |
Action | Make sure the JWT token is signed properly. |
Explanation | A JWT token cannot be validated because the signature could not be verified. The reason for the error is shown after the message. |
Action | If using an asymmetric signature, ensure that the public key in the certificate can be used for digital signature purposes. Check the keyStore element referenced by the default SSL configuration in the server.xml file to find information about the key store that contains the key. Also, see the user action for the message that appears after this error. |
Explanation | The jwkEndpointUrl attribute was not provided in the OpenID Connect client configuration. |
Action | Set the jwkEndpointUrl attribute to the URL of the OpenID Connect Provider's JSON Web Key. |
Explanation | A token can not be validated because the current time shown is not between the token issue and expiration times. |
Action | Make sure that OpenID Connect client (relying party or RP) and OpenID Connect provider (OP) system clocks are in sync (if they are on two systems). |
Explanation | The aud claim in the token must be specified in the audiences attribute of the OpenID Connect client configuration, or all audiences must be allowed by specifying the ALL_AUDIENCES value in the audiences attribute of the client configuration. |
Action | Make sure that the audiences attribute specified in the OpenID Connect client configuration is correct. If you wish to allow all aud claims, the ALL_AUDIENCES value must be specified for the audiences attribute in the OpenID Connect client configuration. Otherwise, the aud claim provided in the token must be contained within the audiences attribute value in the OpenID Connect client configuration. The value is case sensitive. |
Explanation | The token must contain an iat (issued at) claim. |
Action | Obtain a valid token from the OpenId Connect provider. |
Explanation | The token can not be validated because the signature could not be verified. The reason for this error is displayed in the message. Possible causes of this error could be a mismatch in the signature algorithm or shared key between the OpenID Connect client and OpenID Connect provider. |
Action | See the user action for the cause displayed in the message. If the cause appears to be because of a key mismatch, check the server configuration to make sure the configured signature algorithm and the configured shared key is compatible with that of the OpenID Connect provider. |
Explanation | The token can not be validated because OpenID Connect client (relying party or RP) and OpenID Connect provider (OP) are using different signature algorithms. |
Action | Ensure that the signatureAlgorithm attribute specified in the RP configuration matches the signature algorithm for the OP. |
Explanation | The token can not be validated because the token was not signed. The signature algorithm setting for the OpenID Connect client requires tokens to be signed. |
Action | Do one of the following: 1) Set the signatureAlgorithm attribute in the OpenID Connect client configuration to "none". 2) Send a signed token. |
Explanation | The OpenID Connect client validating the token has configured the audiences attribute to trust certain audiences, so any tokens validated by that client must contain an aud claim. The aud claim in the token must also match one of the audiences configured to be trusted by the client in the audiences configuration attribute. |
Action | Make sure the token provided to your OpenID Connect client contains an aud claim. If you do not wish to validate token audiences, remove the audiences attribute from your OpenID Connect client configuration. |
Explanation | The not before time claim in the token is after the current time and the runtime cannot use the token at present. |
Action | Make sure that the token does not have a "nbf" claim set to a future time and/or synchronize the time between the systems or resubmit the request at a later time. |
Explanation | The token contains an issuer value that is not specified as a trusted issuer in the OpenID Connect client configuration. Tokens that are validated by this OpenID Connect client must be issued by a trusted issuer. |
Action | Verify that the issuer claim value that is in the token is included in the specified attribute in the OpenID Connect client configuration. |
Explanation | The token cannot contain the specified claim because of the value of the specified configuration attribute. |
Action | Either obtain a new token that does not contain the specified claim, or change the specified configuration attribute value to allow the claim to be included in the token. |
Explanation | The OAuth 2.0 specification defines a set of reserved request parameters that must be provided by the client for authorization requests. Values for those reserved parameters cannot be supplied by the user. |
Action | Remove the specified values from the list of values defined in the OpenID Connect client configuration. |
Explanation | The token must contain an issuer claim to identify who issued the token. |
Action | Obtain a new token that includes an issuer claim. |
Explanation | One or more parameters provided in the permission configuration is incorrect and the permission has been discarded. Please analyze the exception mentioned in the message to determine which parameter was the reason for the failure. |
Action | Ensure that the various parameters provided as part of the permission configuration are correct. |
Explanation | A permission class failed to load. If this is a custom permission class packaged in the application, it will be found in later processing and this error can be ignored. |
Action | Ensure that the permission class is a custom class and is stored in application binaries. Otherwise, this error needs further investigation. |
Explanation | This message is for informational purposes only. |
Action | No action is required. |
Explanation | This message is for informational purposes only. |
Action | No action is required. |
Explanation | There was an unexpected exception while processing the decryption by using the custom password encryption service. |
Action | Check the custom password encryption service logs and server logs for more information about the cause of the exception. |
Explanation | There was an unexpected exception while processing the encryption by using the custom password encryption service. |
Action | Check the custom password encryption service logs and server logs for more information about the cause of the exception. |
Explanation | The custom encoded password cannot be processed because the custom password service is not available. |
Action | Make sure that the custom password user feature that implements the com.ibm.wsspi.security.crypto.CustomPasswordEncryption interface is configured and started. |
Explanation | The password was not encrypted or decrypted because the supplied password algorithm name is not supported. |
Action | Make sure that one of the supported algorithms is used. |
Explanation | The specified algorithm is not supported. |
Action | Check the server log and if the custom password encryption is used check the custom password encryption logs for further information. |
Explanation | The password was not encrypted or decrypted because the exception was reported while processing the password. |
Action | Check the server log and if the custom password encryption is used check the custom password encryption logs for further information. |
Explanation | The password was not encrypted or decrypted because the exception was reported while processing the password. |
Action | Check the server log and if the custom password encryption is used check the custom password encryption logs for further information. |
Explanation | The encrypted password was not encoded properly. |
Action | Make sure that the encrypted password is not truncated and encoded by using Base64 encoding. |
Explanation | No IdentityStore object was found to validate the user. Therefore, the user cannot be authenticated. |
Action | Make sure that at least one IdentityStore object supports validation of the user. |
Explanation | The reason that the HttpAuthenticationMechanism object cannot be created varies. The error messages for the HttpAuthenticationMechanism object provide information on why the the HttpAuthenticationMechanism object cannot be created. |
Action | Investigate any error messages from the HttpAuthenticationMechanism object and make corrections based on the error messages. |
Explanation | The cause of the error is a mismatch of the type between the EL result and the expected attribute value. For example, if the expected attribute type is String, the EL result needs to be String. |
Action | Make sure that the annotation contains a valid configuration value. Ensure that the EL expressions are valid, that any referenced beans that are used in the expression are resolvable, and that the type of the result corresponds with the attribute. |
Explanation | A hashAlgorithm parameter list is in the incorrect format and cannot be parsed. |
Action | Correct the hashAlgorithmParameters element on the DatabaseIdentityStore annotation. |
Explanation | The search for the caller failed with an error. |
Action | Review the error message and make corrections to the search based on the error message. |
Explanation | A partial list of groups for the caller is returned instead of a complete list of groups because of an error in the query. |
Action | Review the provided error and make corrections to the query so that the complete list of groups for the caller can be returned. |
Explanation | The credential provided to the IdentityStore object is not a UsernamePasswordCredential class and cannot be validated. |
Action | Review the type of credential passed into the IdentityStore object by the HttpAuthMechanism implementation. |
Explanation | The hash algorithm listed in the hashAlgorithm element on the DatabaseIdentityStoreDefinition annotation was not found. |
Action | Add the custom hash algorithm as a bean that is available to the application. |
Explanation | The query did not return a password for the provided caller query. |
Action | If a password was expected, review the caller query and database contents. |
Explanation | Multiple results were returned for the requested caller. The caller query should only return a single result. |
Action | Review the caller query and database contents. Change the caller query to return one result. |
Explanation | The application deployment failed because more than one HttpAuthenticationMechanism implementation was found. |
Action | Make sure that only one HttpAuthenticationMechanism implementation exists for each module in the application. |
Explanation | The form login or custom form login HttpAuthenticationMechanism bean requires the LoginToContinue annotation for either login to be configured correctly. |
Action | Make sure that the application is annotated with the LoginToContinue annotation in the FormAuthenticationMechanismDefinition or CustomFormAuthenticationMechanismDefinition annotation. |
Explanation | The user registry does not support the supplied credential class for authentication. The javax.security.enterprise.credential.UsernamePasswordCredential class and the javax.security.enterprise.credential.BasicAuthenticationCredential class are supported credential classes. |
Action | Make sure that identity stores are configured or that the user registry uses a supported credential class to authenticate the user. |
Explanation | The reason that the IdentityStore object was not found varies. The error messages for the IdentityStore object provide information about why the IdentityStore object was not found. |
Action | Investigate any error messages from the IdentityStore object, and make corrections based on the error messages. |
Explanation | The application deployment failed because both the login-config element and the HttpAuthenticationMechanism element are defined. Only one of these authentication mechanisms can be used in your application. |
Action | Make sure that only one of the authentication mechanisms is configured. |
Explanation | The password hash for the DatabaseIdentityStore attribute is not valid because the value of the configuration parameter is not valid. Please refer to the javadoc of javax.security.enterprise.identitystore.Pbkdf2PasswordHash interface for the valid value. |
Action | Make sure that the configuration parameter is set correctly. |
Explanation | For the password hash of the DatabaseIdentityStore attribute to be valid, the value of the configuration parameter must be greater than or equal to the minimum value. |
Action | Make sure that the configuration parameter value is equal to or greater than the minimum value. |
Explanation | The password hash from the database is not valid, likely because the format of the password is incorrect. |
Action | Make sure that the password hash in the database has the correct format required by the Pbkdf2PasswordHash implementation. |
Explanation | The user could receive a 401 or 403 error when attempting to log in. The FormLoginHttpAuthenticationMechanism could not be used for the log in because either the loginFormURL attribute or the loginErrorURL attribute is not set in the webAppSecurity element. |
Action | Make sure that both the loginFormURL attribute and the loginErrorURL attribute are set. |
Explanation | Either the loginFormURL attribute or the loginErrorURL attribute does not start with the contextRootForFormAuthenticationMechanism attribute value. |
Action | Make sure that the loginFormURL attribute and the loginErrorURL attribute start with the contextRootForFormAuthenticationMechanism attribute value. |
Explanation | Requests sent to the back-channel logout URIs were interrupted, or another error occurred in scheduling the requests to run. |
Action | Send another logout request to retry the back-channel logout. For more information, see the error included in the message. |
Explanation | The HTTP connection encountered an error, or the connection failed. |
Action | Send another logout request to retry the back-channel logout. For more information, see the error included in the message. |
Explanation | An error occurred in building the logout token string. Alternatively, the issuer of the cached ID token might not match this OpenID Connect provider, or the cached ID token might be missing some claims that are required. |
Action | For more information, see the error included in the message. |
Explanation | An error occurred in building the logout token string. Alternatively, the issuer of the cached ID token might not match this OpenID Connect provider, or the cached ID token might be missing some claims that are required. |
Action | For more information, see the error included in the message. |
Explanation | When both the client_id and id_token_hint parameters are present, the client identifier within the ID token must match the value that is provided for the client_id parameter. |
Action | Ensure that the client_id parameter value matches the aud claim in the ID token. |
Explanation | There are multiple resources with the same name, and the correct authorization policy can not be determined. Resource names must be unique. |
Action | Change the name of one of the resource names so that all resources are unique. |
Explanation | The syntax for defining a role is <{1} name="..." />. |
Action | Change the role definition in the configuration. |
Explanation | Only one definition of a given role is allowed |
Action | Remove the duplicate role definition(s) in the configuration. |
Explanation | Only one definition of a member is allowed per role |
Action | Remove the duplicate role member definition(s) in the configuration. |
Explanation | The application does not have any authorization table defined so the role name required to access the resource will be treated as the group name for the access check. For example, if the role name required to access the resource is Manager, then if the authenticated user belongs to the group Manager, access will be granted. |
Action | The implicit authorization check can be disabled by setting the useGroupToRoleName attribute of the authorization element to false in the server.xml. |
Explanation | The token endpoint request has more than one JWT Token. It is not allowed. |
Action | Make sure only one JWT Token is in the token endpoint request. |
Explanation | The token endpoint request does not have a JWT Token. It can not be processed. |
Action | Make sure that the token endpoint request has a JWT Token. |
Explanation | The OpenID Connect Provider gets an unexpected Exception. |
Action | Please contact IBM. |
Explanation | The JWT claim is not in the expected UTC time integer format. |
Action | Make sure the claim in the JWT token is in the correct format. The UTC time must be in numeric format. |
Explanation | The token endpoint request failed. Can not verify the 'sub' claim of the JWT Token. An unexpected exception happened during verification. |
Action | Make sure the 'sub' claim in the JWT Token is a valid user of the OpenID Connect Provider. |
Explanation | The OpenID Connect Provider has to be in the audience list of the JWT Token. The ID of the OpenID Connect Provider is issuerIdentifier in the configuration, or its Token Endpoint URL. |
Action | Make sure the 'aud' claim in the JWT token includes the targeted OpenID Connect Provider. Please check the issuerIdentifier in the OpenID Connect Provider configuration, or its Token Endpoint URL. |
Explanation | Can not process the token endpoint request because the JWT Token is missing a required claim. |
Action | Add the required claim into the JWT token. |
Explanation | The issuer claim in the JWT Token must match either the client redirect URI or the clientId which is registered in the OpenID Connect Provider. |
Action | Make sure the issuer claim is the client redirect URI or the clientId. Please check the clientId or redirect URI in the OpenID Connect Provider configuration. |
Explanation | The JWT Token is not valid because its subject claim is not found in the OpenID Connect Provider user registry. |
Action | Make sure the subject claim in the JWT Token is a user in the OpenID Connect Provider user registry. |
Explanation | The JWT Token expired. Its expiration time is indicated in the error message. |
Action | Make sure the JWT Token has not expired, synchronize the time between the systems, or increase the expiration time. |
Explanation | The issued-at-time in the JWT Token is after the current time. It is not valid at the time of processing. |
Action | Synchronize the time between the systems, and make sure the 'iat' time is valid or submit the JWT Token at a later time. |
Explanation | The JWT Token issued exceeds the maximum JWT Token Lifetime (tokenMaxLifetime value) which is defined in the OpenID Connect Provider configuration. |
Action | Make sure the JWT Token is issued within the maximum JWT Token Lifetime or increase the tokenMaxLifetime value in the configuration of the server. |
Explanation | The OpenID Connect Provider has set the 'iatRequired' to true. In this case, the 'iat' claim in the JWT Token is required. The missing 'iat' claim results in a failure. |
Action | Either provide an 'iat' claim in the JWT token or set 'iatRequired' to false in the OpenID Connect Provider. |
Explanation | The JWT Token has a not-before claim, but the request time is before the nbf time(not-before-time). |
Action | Make sure a JWT Token is submitted after its not-before-time ('nbf') claim. |
Explanation | A JWT Token, which is issued by the same issuer, can not be submitted twice. The jti value is the unique ID of a Token. |
Action | Make sure each JWT token that is issued by the same issuer, has a unique jti ID. |
Explanation | The JWT token does not contain all of the required claims. |
Action | Supply the required claims in the JWT token. |
Explanation | The request is not valid because it is missing the required JWT Token. |
Action | Make sure the request contains one JWT token. |
Explanation | The server gets an exception which was not expected. |
Action | Make sure the configuration in the server.xml file is correct. If this happens consistently, please contact IBM. |
Explanation | The JWT token is not valid. It is presented prior to its 'nbf' claim (not-before-time). |
Action | Make sure the JWT Token in the request is after the not-before-time ('nbf') time. Synchronize the time between the OpenID Connect Client and Provider, or increase the clock skew in the OpenID Connect Provider configuration. |
Explanation | The 'iat' claim in the JWT token indicates the token is issued in the future. It is not valid at the current time in the OpenID Connect Provider. |
Action | Make sure the time between the OpenID Connect Client and Provider are synchronized, and do not submit a JWT Token whose 'iat' is in the future. |
Explanation | The JWT token 'exp' time has passed the current time plus the clock skew. It is not valid. |
Action | Make sure the JWT Token does not expire, or synchronize the time between the OpenID Connect Client and Provider. |
Explanation | The 'iss' claim in the JWT token must be either the client ID or any client redirect uri. |
Action | Make sure the 'iss' claim in the JWT Token is the client ID or any client redirect uri. |
Explanation | The 'aud' claim in the JWT token has to be either the issuer identifier or the token endpoint of the OpenID Connect Provider. |
Action | Make sure the 'aud' claim in the JWT Token is either the issuer identifier or the token endpoint of the OpenID Connect Provider. |
Explanation | The 'aud' claim in the JWT token has to be the issuer identifier which is explicitly specified in the configuration. |
Action | Make sure the 'aud' claim in the JWT Token matches the issuer identifier defined in the configuration. |
Explanation | During verification of the 'sub' claim in the User Registry of the OpenID Connect Provider. An unexpected Exception occurs. |
Action | Make sure the User Registry in the OpenID Connect Provider is functioning properly and the sub(user) is a valid user in the Registry. |
Explanation | The indicated signature algorithm for the JWT Token needs a public key to verify the incoming JWT Token but failed to get one. |
Action | Make sure the configuration of the jwtGrantType and keyStore are set up properly, and also make sure the trustStore location and password are correct. |
Explanation | The OpenID Connect Provider can not get a trust store to verify the JWT token. The configuration of the openidConnectProvider needs to be set up properly. |
Action | Make sure the configuration of the jwtGrantType and the trustStoreRef in the openidConnectProvider are set up properly, and also make sure the trustStore location and password are correct. |
Explanation | The OpenID Connect Provider gets an unexpected error. |
Action | Make sure the configuration is set up properly. If the problem consists, please contact IBM. |
Explanation | The JWT Token signed with the RS256 signature algorithm is not supported in the OAuth token endpoint. |
Action | To use the JWT Token with the RS256 signature algorithm, please set up a proper openidConnectProvider configuration and also send the request through the OpenID Connect token endpoint. |
Explanation | The URI value for the metadata field that is specified in the message may use the HTTP scheme only if the OAuth client is a confidential client. Otherwise, the HTTPS scheme must be used. |
Action | Update the URI to use the HTTPS scheme, or update the OAuth client to be a confidential client. |
Explanation | The social media login configuration is not an OpenID Connect client, so it does not support back-channel logout. |
Action | Use the logout endpoint that is appropriate for the social media login configuration. |
Explanation | The token endpoint authentication method that is specified in the message requires a client secret to authenticate with the token endpoint of the OpenID Connect provider. |
Action | Configure a client secret for the OpenID Connect client, or switch the token endpoint authentication method of the client to one that does not require a client secret. |
Explanation | The OpenID Connect client configuration might be missing information, or the client encountered an error while communicating with the OpenID Connect provider. |
Action | See the error in the message for more information. |
Explanation | The OpenID Connect client configuration is missing information that is needed. |
Action | See the error in the message for more information. Verify that the OpenID Connect client configuration is complete and accurate. |
Explanation | The endpoint URL must use the HTTPS protocol to ensure that requests are secure. |
Action | Update the endpoint URL to use the HTTPS protocol. |
Explanation | The OpenID Connect client configuration might be missing information, or the client encountered an error while communicating with the OpenID Connect provider. |
Action | See the error in the message for more information. |
Explanation | The OpenID Connect client must discover metadata for the OpenID Connect provider, but the client does not have a providerURI attribute configured. |
Action | Specify a value for the providerURI attribute in the OpenID Connect client configuration, or ensure that the OpenID Connect provider metadata in the client configuration contains all of the data that is required by the OpenID Connect client. |
Explanation | The property that is specified in the message must be present in the OpenID Connect provider metadata, but it is missing. |
Action | Verify that the providerURI attribute for the OpenID Connect client is set to the correct discovery URL for the OpenID Connect provider. |
Explanation | The authorization endpoint URL in the OpenID Connect client configuration might be malformed or missing, or the OpenID Connect client failed to obtain the authorization endpoint URL from the OpenID Connect provider. |
Action | See the error in the message for more information. Verify that the OpenID Connect client configuration is complete and accurate. |
Explanation | The response from the OpenID Connect provider might be missing information. There might be a problem with the code returned from the OpenID Connect provider. |
Action | See the error in the message for more information. |
Explanation | The authorization request to the OpenID Connect provider did not include a state parameter. |
Action | Ensure that the authorization request to the OpenID Connect provider includes a state parameter. |
Explanation | The state value might be truncated, or the state value did not originate from this OpenID Connect client. |
Action | Check the format of the state parameter. Compare the value to state parameters from recent OpenID Connect requests that were handled by this OpenID Connect client. |
Explanation | The state parameter might be from an old authorization request, or the value for the state parameter is incorrect. |
Action | Verify that the state parameter in the callback request matches a state value for a recent OpenID Connect request. |
Explanation | The state parameter might be from an old authorization request, or the value for the state parameter is incorrect. |
Action | Verify that the state parameter in the callback request matches a state value for a recent OpenID Connect request. |
Explanation | The OpenID Connect provider took too long to respond, or the user took too long to authenticate with the OpenID Connect provider. |
Action | Ensure that the user does not take too much time to authenticate with the OpenID Connect provider. |
Explanation | The OpenID Connect client might have used a different value for the redirect_uri parameter in the authorization request that was sent to the OpenID Connect provider. |
Action | Check the OpenID Connect client configuration to ensure the redirect URI is configured correctly. |
Explanation | The OpenID Connect provider encountered an error when it tried to process the authentication request. |
Action | See the value that is in the message for more information. Error codes are defined by RFC 6749. |
Explanation | A problem might exist with the issuer, azp, iat, or exp claim validation, or with the token signature validation. |
Action | For more information, see the error in the message. |
Explanation | The OpenID Connect client might be missing information, the request to the token endpoint failed, or another error occurred while processing the token endpoint response. |
Action | See the error in the message for more information. Verify that the OpenID Connect provider returned a code in the authentication response. |
Explanation | The claim that is specified in the message must be present in the token, but it is missing. |
Action | Check the format and content of the token that is returned from the OpenID Connect provider. |
Explanation | The User Info response from the OpenID Connect provider might be malformed or missing information, or the OpenID Connect provider encountered an error when it handled the request. |
Action | For more information, see the error in the message. Verify that the User Info URL for the OpenID Connect provider is correct. |
Explanation | The OpenID Connect client did not receive a successful response from the OpenID Connect provider. |
Action | For more information, see the status code and error response in the message. |
Explanation | The verification key might be missing, the OpenID Connect client encountered an error while fetching the key from the OpenID Connect provider, or another error occurred. |
Action | For more information, see the error in the message. |
Explanation | The OpenID Connect client cannot establish a connection with the JWK URI within the configured time frame. |
Action | Update the jwksConnectTimeout property in the OpenID Connect client configuration. Verify that the OpenID Connect provider is reachable. |
Explanation | The OpenID Connect client cannot read the JWK data from the JWK URI within the configured time frame. |
Action | Update the jwksReadTimeout property in the OpenID Connect client configuration. Verify that the OpenID Connect provider is reachable. |
Explanation | The specified response type is not valid. |
Action | Specify one of the valid response types. |
Explanation | The claim value is incorrect or malformed. The configuration for the OpenID Connect client might be incorrect, or the token was created with incorrect values. |
Action | Ensure the attribute in the OpenID Connect client configuration that is related to the claim that is specified in the message is configured correctly. |
Explanation | Information is missing from the token and validation of the token cannot be completed. |
Action | Review the log for any earlier errors for details on the failure. Check the format and content of the token that is returned from the OpenID Connect provider. |
Explanation | The claim that is specified in the message must have a valid value. |
Action | The OpenID Connect provider returns an ID token with an empty claim. If a claim is present, it must contain a valid value. Check the format and content of the token that is returned from the OpenID Connect provider. |
Explanation | Tokens that are expired are not valid. |
Action | Obtain a new token that is not expired. Synchronize the clock times between the token issuer and the OpenID Connect client. |
Explanation | The value that is specified in the message for the claim must be a time in the past. |
Action | Use the token after the time that is specified in the message expires, or obtain a new token. |
Explanation | Either the OpenID Connect provider did not return a required parameter or failed to process the token request. |
Action | Verify that the configured token endpoint is correct and capable of responding to OAuth token requests. |
Explanation | The OpenID Connect client is configured to use JSON Web Tokens for client authentication, but an error occurred while creating the token. |
Action | For more information, see the error in the message. |
Explanation | The OpenID Connect client configuration is missing data, or a key cannot be found with the key alias name in the SSL configuration for the OpenID Connect client. |
Action | Ensure that the OpenID Connect client has a key alias name and SSL reference configured. Verify that the keystore that the SSL configuration references contains a key whose alias matches the key alias name in the OpenID Connect client configuration. |
Explanation | The OpenID Connect token endpoint requires client authentication, but the OpenID Connect client might be missing information, or the client encountered another error while setting up the authentication data. |
Action | See the error in the message for more information. |
Explanation | The OpenID Connect client must configure a key alias name to define the key to use to sign the JWT. The same key alias must be used for both the private key that is used to sign the JWT and the corresponding public key. |
Action | Verify that the OpenID Connect client has a key alias name configured. |
Explanation | The OpenID Connect client must configure a keystore reference to define where to find the key to use to sign the JWT. |
Action | Verify that the OpenID Connect client has a keystore reference configured. |
Explanation | The OpenID Connect client must use a private key to sign the JSON Web Token for client authentication. The client encountered an error while retrieving the private key. |
Action | See the error in the message for more information. |
Explanation | The x5t header is the certificate thumbprint of the public key that corresponds to the private key that is used to sign the JSON Web Token. The x5t header helps OpenID Connect providers identify which certificate to use to verify the signature of the JWT. The client encountered an error while retrieving the public key. |
Action | See the error in the message for more information. |
Explanation | The attribute cannot be resolved as an expression. The EL result and the expected attribute value type might be mismatched. For example, if the expected attribute type is String, then the EL result must be a String. |
Action | Make sure that the annotation contains a valid configuration value. Ensure that the EL expressions are valid, that any referenced beans in the expression are resolvable, and that the type of the result corresponds with the attribute. |
Explanation | The attribute cannot be resolved as an expression. The EL result and the expected attribute value type might be mismatched. For example, if the expected attribute type is String, then the EL result must be a String. |
Action | Make sure that the annotation contains a valid configuration value. Ensure that the EL expressions are valid, that any referenced beans in the expression are resolvable, and that the type of the result corresponds with the attribute. |
Explanation | The attribute cannot be resolved as an expression. The EL result and the expected attribute value type might be mismatched. For example, if the expected attribute type is String, then the EL result must be a String. |
Action | Make sure that the annotation contains a valid configuration value. Ensure that the EL expressions are valid, that any referenced beans in the expression are resolvable, and that the type of the result corresponds with the attribute. |
Explanation | The attribute cannot be resolved as an expression. The EL result and the expected attribute value type might be mismatched. For example, if the expected attribute type is String, then the EL result must be a String. |
Action | Make sure that the annotation contains a valid configuration value. Ensure that the EL expressions are valid, that any referenced beans in the expression are resolvable, and that the type of the result corresponds with the attribute. |
Explanation | The OpenID Connect client encountered an error while validating the tokens that were returned from the OpenID Connect provider, or an error occurred while using the information in the tokens to build the credential. |
Action | For more information, see the error in the message. |
Explanation | The OpenIdClaims object on the OpenIdContext bean is missing the required subject value. Therefore, the subject value of the claims JSON object cannot be set. |
Action | Review the logs for earlier errors related to OpenID authentication. |
Explanation | The OpenID Connect client encountered an error while verifying the expected type of fields on the OpenID Claims object. A frequent error is that the actual type of the returned value does not match the expected type. |
Action | For more information, see the error in the message. |
Explanation | The value of the attribute must not be a negative integer. If the attribute value is an EL expression, the value must not resolve to a negative integer. |
Action | Update the attribute to use a non-negative integer. If the attribute value is an EL expression, update the referenced bean to resolve to a non-negative integer. |
Explanation | The token must be signed with one of the algorithms that is specified in the message. |
Action | Ensure the token is signed with one of the allowed algorithms, or update the configuration for the component that receives the token to allow the algorithm that is specified in the message. |
Explanation | The server failed to retrieve the key that is needed to verify the JWT signature. The key might be loaded from a JSON Web Key (JWK) URL, a keystore, or a shared key that is specified in the server configuration. |
Action | Ensure that the configuration for the component that receives the token specifies a JWK URL, an appropriate keystore, or a shared key. |
Explanation | This message is for informational purposes only. |
Action | No action is required. |
Explanation | This message is for informational purposes only. |
Action | No action is required. |
Explanation | This message is for informational purposes only. |
Action | No action is required. |
Explanation | The JACC service failed to start. |
Action | Review the JACC provider logs and the server logs for more information. |
Explanation | The JACC provider cannot be initialized because the Policy class name is not set. |
Action | Make sure that the property (javax.security.jacc.policy.provider) of the JACC user feature sets the proper class name. |
Explanation | The JACC provider cannot be initialized because the PolicyConfigurationFactory class name is not set. |
Action | Make sure that the property (javax.security.jacc.PolicyConfigurationFactory.provider) of the JACC user feature sets the proper class name. |
Explanation | The Policy class name which is specified by the JVM system property is not identical to the Policy class name which is specified by the bundle property of the JACC provider class. The value of the system property is ignored and the value of the bundle property is used. |
Action | The JVM system property is not required. Remove the JVM system property and restart the server. |
Explanation | The PolicyConfigurationFactory class name which is specified by the JVM system property is not identical to the PolicyConfigurationFactory class name which is specified by the bundle property of the JACC provider class. The value of the system property is ignored and the value of the bundle property is used. |
Action | The JVM system property is not required. Remove the JVM system property and restart the server. |
Explanation | The JACC service is unable to load the specified PolicyConfigurationFactory class. |
Action | Review the JACC provider logs and the server logs for more information. |
Explanation | The JACC service is unable to set the Policy provider class due to the exception. |
Action | Review the JACC provider logs and the server logs for more information. |
Explanation | The JACC service is unable to get the JACC provider PolicyConfiguration object. This might be a severe error in the JACC provider. |
Action | Review the JACC provider logs and the server logs for more information. |
Explanation | The JACC service is unable to propagate the Web security constraints to the JACC provider due to the unexpected exception. |
Action | Review the JACC provider logs and the server logs for more information. |
Explanation | Authorization for the specified resource failed. |
Action | Review the JACC provider logs and the server logs for more information. |
Explanation | The JACC service is unable to process the EJB security roles because the required module is not available. |
Action | Review the JACC provider logs and the server logs for more information. |
Explanation | The JACC service is unable to process the Web security roles because the required module is not available. |
Action | Review the JACC provider logs and the server logs for more information. |
Explanation | The JACC service is unable to get the JACC provider PolicyConfiguration object. This might be a severe error in the JACC provider. |
Action | Review the JACC provider logs and the server logs for more information. |
Explanation | The JACC service is unable to propagate the Web security constraints to the JACC provider due to the unexpected exception. |
Action | Review the JACC provider logs and the server logs for more information. |
Explanation | Authorization for the specified Web resource failed. |
Action | Review the JACC provider logs and the server logs for more information. |
Explanation | The JACC service cannot complete the request due to the object of the parameter not being valid. This is an internal error. |
Action | This is an internal error. If the problem persists, see the problem determination information on the WebSphere Application Server Support page at http://www.ibm.com/software/webservers/appserv/was/support/. |
Explanation | The JACC service is unable to get the JACC provider PolicyConfiguration object. This might be a severe error in the JACC provider. |
Action | Review the JACC provider logs and the server logs for more information. |
Explanation | Authorization for the specified resource failed. |
Action | Review the JACC provider logs and the server logs for more information. |
Explanation | The JACC service is unable to propagate the EJB security roles to the JACC provider due to the unexpected exception. |
Action | Review the JACC provider logs and the server logs for more information. |
Explanation | The JACC service cannot complete the request due to the object of the parameter not being valid. This is an internal error. |
Action | This is an internal error. If the problem persists, see the problem determination information on the WebSphere Application Server Support page at http://www.ibm.com/software/webservers/appserv/was/support/. |
Explanation | RACF is not installed. |
Action | Contact the system administrator. |
Explanation | A parameter list error occurred during RACF processing. |
Action | Contact the system administrator. |
Explanation | An internal error occurred during RACF processing. |
Action | If the problem persists, Contact the system administrator. |
Explanation | The SAF recovery environment could not be established. |
Action | If the problem persists, Contact the system administrator. |
Explanation | The specified user was not found in the SAF registry. |
Action | Verify that the user ID is valid. If the user is valid, use the provided SAF return and reason codes to get more information about the cause of the failure. |
Explanation | The specified user ID, or user access to the group, has been revoked by the SAF registry. |
Action | Verify that the user is valid. If the user is valid, use the provided SAF return and reason codes to get more information about the cause of the failure. |
Explanation | The specified user does not have sufficient RACF access authority for the specified APPL-ID. |
Action | Verify that the user has sufficient RACF authority to access the specified APPL-ID profile in the APPL class. |
Explanation | The SAF user that represents the unauthenticated user does not have the RESTRICTED attribute set. The RESTRICTED attribute prevents the unauthenticated user from inheriting access to resources to which it was not explicitly granted access. |
Action | It is recommended that the SAF unauthenticated user has the RESTRICTED attribute set. |
Explanation | The server attempted to create a credential or perform authorization with an APPL-ID, SAF CLASS, or SAF EJBROLE PROFILE that it has not been authorized to access. The set of SAF resources including APPL-IDs, CLASSes, and EJBROLE PROFILEs that the server is permitted to access are defined by the WLP z/OS System Security Access Domain (WZSSAD). The server attempted to access a resource outside of that domain. |
Action | Check that the server needs to access these SAF resources. If so, edit the set of SAF resources that the server is authorized to access. Refer to the infocenter for more information about the WZSSAD. |
Explanation | The specified SAF service did not succeed. |
Action | Use the provided SAF return and reason codes to get more information about the cause of the failure. |
Explanation | The specified SAF resource profile in the specified class does not exist, or the profile exists but is not protected by RACF. |
Action | Verify that SAF resource profile exists in the specified class. Use the provided SAF return and reason codes to get more information about the cause of the failure. |
Explanation | The specified SAF service did not succeed because the specified user or group is not authorized to the specified resource. |
Action | Verify that the user has sufficient RACF authority to access the resource. Use the provided SAF return and reason codes to get more information about the cause of the failure. |
Explanation | The specified UNIX system service failed. |
Action | Use the provided return value, return code and reason code to get more information about the cause of the failure. |
Explanation | The specified SAF service did not succeed because the specified group is not authorized to the specified resource. |
Action | Verify that the group has sufficient RACF authority to access the resource. Use the provided SAF return and reason codes to get more information about the cause of the failure. |
Explanation | The specified group was not found in the SAF registry. |
Action | Verify that the group ID is valid. If the group is valid, use the provided SAF return and reason codes to get more information about the cause of the failure. |
Explanation | The specified group ID has been revoked by the SAF registry. |
Action | Verify that the group is valid. If the group is valid, use the provided SAF return and reason codes to get more information about the cause of the failure. |
Explanation | The specified group does not have sufficient RACF access authority for the specified APPL-ID. |
Action | Verify that the group has sufficient RACF authority to access the specified APPL-ID profile in the APPL class. |
Explanation | The getMvsGroupIds is only valid for MappedGroupCredentials. To get groups for other credential types, use the SAF registry functions |
Action | Do not call the SAFGroupCredential.getMvsGroupIds() command on SAFCredentials unless the credential type is set to MAPPED. To get groups for other credential types, use the SAF registry functions. |
Explanation | The server attempted to use authorized SAF services to perform authentication; however the attempt failed because the server does not have authority to access the indicated APPL-ID resource, according to the WLP z/OS System Security Access Domain (WZSSAD). The server will fall back to using unauthorized SAF services provided by Unix System Services to perform authentication. |
Action | If using authorized SAF services is desired, grant the user associated with the server the proper authority to the APPL-ID resource in the WLP z/OS System Security Access Domain (WZSSAD). Refer to the infocenter for more information about the WZSSAD. If using authorized SAF services is not desired, configure the server to use the unauthorized SAF registry rather than the authorized SAF registry. Refer to the infocenter for details. |
Explanation | A previous authentication attempt failed because the server was not authorized to access the indicated APPL-ID resource (see message CWWKS2930W); however the server is now authorized to access the APPL-ID. Further authentication attempts will proceed using authorized SAF services. |
Action | None. |
Explanation | The message indicates which version of the SAF user registry is in use. There are two versions: (1) the unauthorized version, which uses unauthorized UNIX System Services such as __passwd; (2) the authorized version, which uses authorized SAF services such as initACEE. |
Action | The server must have access to SAFCRED authorized resources and the WLP z/OS System Security Access Domain in order to use the authorized version of the SAF registry. |
Explanation | Using the unauthorized version of the SAF registry on a system where BPX.DAEMON is active requires that all libraries used by Liberty to be under program control. An alternative is to use the authorized version of the SAF registry. |
Action | If the intent was to use the authorized version of the SAF registry, look for error messages earlier in the message.log file that might have prevented the authorized registry from starting. Otherwise consider disabling BPX.DAEMON profile or put all libraries under program control. |
Explanation | The server is not permitted to use the authorized SAF registry. The value of enableFailover prevents the server from using the unauthorized SAF registry. All future authentication attempts will fail. |
Action | If the intent was for the server to use the authorized SAF registry, check that the angel process is running and that the server can access the necessary SAF profiles to use the authorized SAF registry. If the intent was for the server to use the unauthorized SAF registry, the enableFailover setting must be changed to true, which is the default value. |
Explanation | The attribute to get non-OMVS groups is enabled; however, the server does not have access to authorized functions and cannot get the SAF groups. |
Action | The user should enable authorized functions to access non OMVS groups. |
Explanation | The server is in the process of determining whether SAF authorized services or unauthorized UNIX System Services will be used. Currently, SAF authorized services are unavailable. If they remain unavailable, failover to unauthorized UNIX System Services will occur. Failover occurs because, server.xml file contains the safRegistry element with the attribute enableFailover which either defaulted to true true or is explicitly set to true. |
Action | Ignore this message if SAF authorized services are not configured. If SAF authorized services are configured, look for CWWKS2938I indicating that SAF authorized services are now available. If SAF authorized services are configured and CWWKS2938I is not found, look for error messages that describe the error. For more information, see the product documentation about enabling z/OS authorized services. |
Explanation | The server is in the process of determining whether SAF authorized services or unauthorized UNIX System Services will be used. Currently SAF authorized services are unavailable. If they remain unavailable, failover to unauthorized UNIX System Services will not occur. Failover will not occur because, server.xml file contains the safRegistry element with the enableFailover=false attribute. |
Action | Ignore this message if message CWWKS2938I is found indicating SAF authorized services are available. If CWWKS2938I is not found, the configuration is invalid. To use the SAF user registry you must use either SAF authorized services or failover to unauthorized UNIX System Services via the enableFailover attribute. For more information, see the product documentation about enabling z/OS authorized services. |
Explanation | SAF authorized services are available. If SAF authorized services become unavailable when the enableFailover attribute is true, the SAF registry uses the unauthorized UNIX System Services. Otherwise, attempts to access protected resources will fail. |
Action | No action is required. |
Explanation | The server cannot create the default credential that represents the SAF unauthenticated user. The SAF unauthenticated user is specified by the unauthenticatedUser attribute in the server configuration. The server cannot perform authorization checks for unauthenticated users; therefore all such authorization attempts will fail. |
Action | Address the error described in the message. |
Explanation | The server failed to read the APPLDATA field from the given SAF EJBROLE profile. The APPLDATA field contains the RunAs user for SAF delegation. |
Action | The error message includes the SAF return and reason codes identifying the cause of the failure. |
Explanation | The userRegistry configuration element references specific UserRegistry instances by their ID values. |
Action | Specify a refId parameter in the userRegistry configuration. |
Explanation | Each UserRegistry configuration specifies an id parameter. |
Action | Specify the id parameter for a configured element, or create the required configuration. |
Explanation | Each UserRegistry implementation bundle specifies its provided type. |
Action | Specify a supported type, or install the bundle that provides the UserRegistry instance of the requested type. |
Explanation | The configuration for the registry type does not define an ID. |
Action | Define an ID for the configuration of the registry type. |
Explanation | The service does not define the com.ibm.ws.security.registry.type property. |
Action | Define the com.ibm.ws.security.registry.type property for the service. |
Explanation | No UserRegistry implementation is available through the OSGi service registry. |
Action | Specify a UserRegistry implementation feature. |
Explanation | Multiple UserRegistry implementations are available through the OSGi service registry. |
Action | Specify only one UserRegistry implementation feature. If you are selecting multiple userRegistries, then you must include the federation feature for the federation of user registries. |
Explanation | Multiple registry configurations define the same ID. This is not supported. |
Action | Change the ID of one of the conflicting registry configurations so that it is unique. |
Explanation | The user registry federation is enabled and the configured user registry is federated. |
Action | If repository federation is not required, update the configuration in the server.xml file to disable federation |
Explanation | The user registry federation is enabled and the configured user registry is that was previously federated is removed from federation. |
Action | If repository federation is not required, update the configuration in the server.xml file to disable federation |
Explanation | An attempt was made to federate user registries, but it failed. |
Action | See the problem determination information on the WebSphere Application Server Support web page: http://www.ibm.com/software/webservers/appserv/was/support |
Explanation | The syntax for defining a user is <user name="..." password="..." />. |
Action | Change the user definition in the configuration. |
Explanation | The syntax for defining a group is <group name="...">. |
Action | Change the group definition in the configuration. |
Explanation | The syntax for defining a member is <member name="...">. |
Action | Change the member definition in the configuration. |
Explanation | No users are defined for the configuration. This might be intentional, but is likely to be a configuration error. |
Action | If required, define at least one user in the configuration. |
Explanation | User names must be unique. |
Action | Define only one user with the specified name. |
Explanation | Group names must be unique. |
Action | Define only one group with the specified name |
Explanation | Groups only support one member entry per user name. |
Action | Define only one member entry for the user in the specified group. |
Explanation | The name specified for the member entry does not match any defined users. |
Action | Check the spelling of the member name and ensure it matches a user defined in the registry. |
Explanation | The X.509 certificate mapping mode was set to CUSTOM, but no custom X.509 certificate mapper was bound to the basic registry. |
Action | Ensure that the certificateMapperId attribute in the basic registry is configured to point to a valid custom X.509 certificate mapper. |
Explanation | The value that is returned from the custom X.509 certificate mapper does not map to a user in the basic registry. |
Action | Ensure that the user exists in the basic registry and that the mapping is valid. |
Explanation | The custom X.509 certificate mapper threw a CertificateMapNotSupportedException exception. |
Action | If the exception was unexpected, review the custom X.509 certificate mapper implementation and make necessary changes. |
Explanation | The custom X.509 certificate mapper threw a CertificateMapFailedException exception. |
Action | If the exception was unexpected, review the custom X.509 certificate mapper implementation and make necessary changes. |
Explanation | The DN of the subject principal in the X.509 certificate does not map to a valid basic registry user. |
Action | Ensure that the DN of the subject principal contains a 'cn' relative distinguished name (RDN) and that a user in the basic registry matches the value of the RDN. |
Explanation | The certificateMapMode configuration attribute for the basic registry is set to IGNORE. |
Action | To enable the basic registry to process X.509 certificate authentication requests, change the certificateMapMode configuration attribute to allow processing. |
Explanation | The specified attribute must be defined. |
Action | Specify the value for the missing attribute. |
Explanation | The SSL configuration alias, host, or port provided in the SSL-LDAP configuration is incorrect. |
Action | Provide the correct SSL configuration information needed to connect to the SSL-enabled LDAP server. |
Explanation | The following LDAP server types are supported: Netscape Directory Server, IBM Lotus Domino, IBM SecureWay Directory Server, Microsoft Active Directory, Sun Java System Directory Server, IBM Tivoli Directory Server, Novell eDirectory, Custom. |
Action | Specify a supported LDAP server type. |
Explanation | If the sslEnabled attribute is set to true, you must also enable the SSL feature. |
Action | Either set the sslEnabled attribute to false, or enable the SSL feature. |
Explanation | The syntax for defining a failover server is <server host="..." port="..." />. |
Action | Fix the failover server definition in the configuration. |
Explanation | The server may be down or the port may be wrong. |
Action | Verify the server is up and the port number is correct. |
Explanation | The bindDN and bindPassword are incorrect or the port may be wrong. |
Action | Check the configured bindDN and bindPassword are correct for the configured LDAP server. |
Explanation | An exception occurred while binding with the provided caller. |
Action | Review the provided exception. |
Explanation | An exception occurred while searching for the provided caller. |
Action | Review the provided exception. |
Explanation | An exception occurred searching for groups of the specified user. |
Action | Review the provided exception. |
Explanation | Multiple results were returned for the requested caller. The caller search should only return a single result. |
Action | Review the callerSearchFilter, searchBase, and repository contents. |
Explanation | An exception occurred searching for attributes on the specified entity. |
Action | Review the provided exception. |
Explanation | The specified caller does not have the specified attribute as set on the LdapIdentityStore. |
Action | Review the callerNameAttribute and repository contents. |
Explanation | The specified group does not have the specified attribute as set on the LdapIdentityStore. |
Action | Review the groupNameAttribute and repository contents. |
Explanation | Each TokenService implementation bundle specifies its provided type. |
Action | Specify a supported type, or install the bundle that provides the TokenService instance of the requested type. |
Explanation | The token cannot be recreated by the currently configured token services. |
Action | Check that at least one feature includes a token service that is properly configured to recreate the token. |
Explanation | The token cannot be recreated by the currently configured token services. |
Action | Check that at least one feature includes a token service that is properly configured to recreate the token. |
Explanation | The constrained delegation (S4U2self and S4U2proxy) APIs require a minimum Java runtime environment version of IBM JavaSE 1.8. |
Action | Make sure to use a Java runtime environment of IBM JavaSE 1.8. |
Explanation | The specified OSGi service is not available. |
Action | Ensure that the constrained delegation feature is enabled and make sure to use a Java runtime environment of IBM JavaSE 1.8. Review the server logs for more information. |
Explanation | The specified OSGi BundleContext is not available. |
Action | The bundle may still be loading. Try again later. |
Explanation | The service filter provided resulted in an exception while retrieving the TokenService. |
Action | The service filter is generated from the SSO token type stored in the serialized Token. Ensure the SSO token type configured for all servers does not result in an invalid OSGi service filter. |
Explanation | The token factory was not initialized. |
Action | Validate the Token Manager configuration in the server.xml file, or any other resource specified by the configuration. |
Explanation | The unique_id parameter is null or was not specified in the token data. |
Action | Validate that the user has a unique ID. If using a custom user registry, validate that the token data contains a value for the unique_id parameter. |
Explanation | The specified key is missing, so the LTPA token cannot be created. |
Action | Explore the properties file in which the LTPA key information is stored, and check that the key information includes a secret key, a private key and a public key. |
Explanation | The LTPA keys do not exist and are generated automatically. Any services requiring LTPA will not start until the LTPA keys have been generated and the configuration is ready. |
Action | No action is required. |
Explanation | This message is for informational purposes only. |
Action | No action is required. |
Explanation | This message is for informational purposes only. |
Action | No action is required. |
Explanation | The LTPA keys could not be read or created at the specified location. |
Action | Ensure the location is accessible by the server process. Any FFDCs might indicate a fatal error in generating or loading the keys. |
Explanation | The LTPA keys files must be reloaded due to a change to the LTPA keys files or the configuration. |
Action | Ensure that all servers that participate in single sign-on share the same LTPA keys and password. |
Explanation | The LTPA key cannot be created. |
Action | Any FFDCs might indicate a fatal error in generating the keys. |
Explanation | The LTPA validation keys are used only if the notUseAfterDate attribute value is in the future. |
Action | Update the notUseAfterDate attribute value to a future date if the LTPA keys must be used. Otherwise, delete the LTPA keys file. |
Explanation | The notUseAfterDate attribute value must be formatted in the ISO date, time, and zone format. The following example shows the ISO date format: "2023-04-18T18:08:35Z". |
Action | Update the notUseAfterDate attribute value to a ISO date, time, and zone format. |
Explanation | The LTPA validationKeys element requires the filename and password attributes. |
Action | Add the missing attributes. |
Explanation | The validation keys file does not exist. |
Action | Make sure that the validation keys file exists in the specified location that is specified by the validationKeys element. |
Explanation | The value for the monitorInterval attribute is zero or less than zero. The directory cannot be monitored for any create, delete, or modify actions on files with the .keys suffix and dynamic reload cannot occur. |
Action | Set the monitorInterval attribute to an interval that is greater than zero. |
Explanation | The SPNEGO configuration has been successfully processed. |
Action | None |
Explanation | The SPNEGO configuration has been successfully modified. |
Action | None. |
Explanation | The Kerberos configuration is not specified in the server.xml file. The default Kerberos configuration file name and path will be used. See the JDK for the default Kerberos configuration file name and path. |
Action | If the user would like to use a different fully qualified Kerberos configuration file name and path, you must specify the fully qualified Kerberos configuration file name and path, which can also include a supported variable, in the server.xml file. |
Explanation | The Kerberos configuration file specified in the server.xml file could not be found. |
Action | Verify the fully qualified Kerberos configuration file name and path, which can also include a supported variable, to make sure that it matches the information provided in the server.xml file. |
Explanation | The default Kerberos keytab file name and path are used if a Kerberos keytab file is not specified in the server.xml file. See the JDK document for the default Kerberos keytab file name and path. |
Action | If the user would like to use a different fully qualified Kerberos keytab file name and path, you must specify the fully qualified Kerberos keytab file name and path, which can also include a supported variable, in the server.xml file. |
Explanation | The Kerberos keytab file specified in the server.xml file could not be found. See the JDK document for the default Kerberos keytab file name and path. |
Action | Verify the fully qualified Kerberos keytab file name and path, which can also include a supported variable, to make sure that it matches the information provided in the server.xml file. |
Explanation | SPNEGO authentication is not supported for this client browser. |
Action | Configure the client browser to perform SPNEGO authentication. |
Explanation | The client browser configuration is correct, but you have not logged into a supported Windows domain. Or the SPNEGO configuration is not correct so the client browser does not send the SPNEGO or Kerberos token. |
Action | Verify that you login to the supported Windows domain and also verify the SPNEGO configuration on the server and Windows domain. |
Explanation | Can not create a GSSCredential for the service principal name. SPNEGO authentication will not be used for this SPN. |
Action | Verify the service principal name format, and make sure it exists on the Windows domain and the Kerberos keytab file contains the service principal name. |
Explanation | Can not create a GSSCredential for any of the service principal names. SPNEGO authentication will not be used. |
Action | Verify the service principal name format, and make sure it exists on the Windows domain and the Kerberos keytab file contains the service principal name. |
Explanation | The client delegated GSSCredentials were not found, so the client subject will not have the client GSSCredentials. |
Action | If the client delegated GSSCredentials are needed in the subject, configure the SPN to be trusted for Kerberos services on the Windows domain. |
Explanation | Error getting the HttpServletResponse's getWriter; can not write the error page to the HttpServletResponse. |
Action | See the exception information for additional details. |
Explanation | The Kerberos configuration file is not specified in the server.xml file and the default Kerberos configuration file could not be found. |
Action | Verify the default Kerberos configuration file name and path, or update the server.xml with the desired configuration file to use. |
Explanation | The default Kerberos keytab file could not be found. |
Action | The Kerberos keytab file was not specified in the server.xml file and the default could not be found. Verify the default Kerberos keytab file name and path or update the server.xml with the desired Kerberos keytab file to use. |
Explanation | The servicePrincipalNames are not specified in the server.xml file, the default will be used. |
Action | Specify a value for the servicePrincipalNames attribute if the default value should not be used. |
Explanation | Can not find a GSSCredential for the service principal name. |
Action | Verify the service principal names, and make sure it is defined in the Windows domain and Kerberos keytab file. |
Explanation | The servicePrincipalNames have multiple SPNs for the same host name. The first SPN will be used and other SPNs will be ignored. |
Action | Verify the servicePrincipalNames to make sure there is only one SPN per host name. |
Explanation | The custom error page can not be loaded because a malformed URL is specified. |
Action | Review the custom error page and modify it to conform with a well-formed URL syntax. |
Explanation | The custom error page cannot be loaded due to the exception. The default will be used. |
Action | Review the custom error page and make sure it exists, and verify the content type and content encoding. |
Explanation | The custom error page cannot be loaded due to the exception when getting the content type. |
Action | Review the custom error page content type to make sure it is valid. |
Explanation | The SPNEGO or Kerberos token used to authenticate the request is valid, but the GSSContext cannot be established. |
Action | If no additional error message is displayed, enable JGSS and KRB5 debugging. Refer to the JDK documentation for instructions on enabling JGSS and KRB5 debugging. Verify the SPNEGO configuration and make sure the client, SPN, and Kerberos keytab files use the same encryption type that is specified in the Kerberos configuration file. |
Explanation | Can not get the delegate service SPN from the GSSCredential. The client GSSCredential for the proxy will not be in the subject. |
Action | Verify the service principal name format, and make sure it exists on the Windows domain and that the Kerberos keytab file contains the service principal name. |
Explanation | Can not authenticate to the Key Distribution Center (KDC). |
Action | Verify the service principal name format, and make sure it exists on the Windows domain and that the Kerberos keytab file contains the service principal name. |
Explanation | To recognize each attribute, a system property needs to be set, which is a system-wide setting. Different values for a system-wide setting cannot be recognized. |
Action | Specify the attribute in only one of the configuration elements. |
Explanation | SPNEGO authentication failed. For more information, check the server log messages. |
Action | Verify the server configuration and the Kerberos configuration and make sure that the server clock is in sync with the Key Distribution Center (KDC). |
Explanation | Can not impersonate the user due to the unexpected exception. |
Action | Ensure the delegate service principal name (SPN) is enabled for the delegate and review the server logs for more information. |
Explanation | Can not impersonate the user due to the unexpected exception. |
Action | Ensure that the S4U2proxy attribute is set to true in the SPNEGO element configuration, and that the delegate service SPN is enabled for the delegate in the Key Distribution Center (KDC), and that the client service ticket has a forwardable flag set to true, and the delegate service tickets have a forwardable flag set to true. Review the server logs for more information. |
Explanation | Can not process the method because the constrained delegation S4U2self is not enabled. |
Action | Ensure that the constrained delegation feature is enabled, and the S4U2self attribute is set to true in the constrained delegation configuration in the server.xml file. Review the server logs for more information. |
Explanation | Can not process the method because the constrained delegation S4U2proxy is not enabled. |
Action | Ensure that the constrained delegation feature is enabled, and the S4U2proxy attribute is set to true in the constrained delegation configuration in the server.xml file. Review the server logs for more information. |
Explanation | The Kerberos constrained delegation feature cannot be enabled due to the Java runtime vendor and version. |
Action | Use the Java vendor and version that is supported by the Kerberos constrained delegation feature. |
Explanation | The configuration refers to a file that does not exist, or could not be read. |
Action | Ensure that the configuration points to a file that exists and is readable by the application process. |
Explanation | The configured file was successfully located. |
Action | No action is required. |
Explanation | Either the specified Kerberos principal is invalid, or the Kerberos credential cache (ccache) is invalid or expired. |
Action | Ensure that a valid Kerberos principal is specified and that the Kerberos credential cache (ccache) is valid and not expired. |
Explanation | Either the specified Kerberos principal or the Kerberos keytab file is invalid. |
Action | Ensure that a valid Kerberos keytab file is specified and that it contains a valid Kerberos principal. |
Explanation | Either the specified Kerberos principal or the default Kerberos keytab file is invalid. |
Action | Ensure that a valid Kerberos keytab file is specified and that it contains a valid Kerberos principal. |
Explanation | A null string was specified for the authentication filter in the server.xml file. |
Action | Correct the authentication filtering rule. |
Explanation | The filter condition is malformed, can not have more than one value specified. |
Action | Verify the filter value in the server.xml file. |
Explanation | The filter match type should be one of ==, !=, %=, > or <. |
Action | Verify the filter match type in the server.xml file. |
Explanation | The filter match type should be one of equals, notContain, contains, greaterThan or lessThan. |
Action | Verify the filter match type in the server.xml file. |
Explanation | A bad IP address range was specified. The IP address range must contain only wildcards after the first range. |
Action | Ensure everything after the first range specified is a wildcard. |
Explanation | Could not obtain a host name for the IP address specified. |
Action | Validate the IP address range specified. |
Explanation | A conversion error occurred while converting the IP attribute value to an IP address. |
Action | Validate the IP attribute specified in the server.xml file. |
Explanation | The authFilter element is not specified in the server.xml file. |
Action | Ensure the authFilter element is specified in the server.xml file. |
Explanation | The authentication filter configuration has been successfully processed. |
Action | No action required. |
Explanation | The authentication filter configuration has been successfully modified. |
Action | No action required. |
Explanation | The authFilter element specified in the server.xml file is missing the required id attribute so this authFilter element will not be used. |
Action | Ensure the authFilter element specified in the server.xml file has the id attribute. |
Explanation | The SAML Web SSO Version 2.0 configuration has been successfully processed. |
Action | No action is required. |
Explanation | The SAML Web SSO Version 2.0 configuration has been successfully processed. |
Action | No action is required. |
Explanation | The SAML Web SSO Version 2.0 endpoint service is activated. |
Action | No action is required. |
Explanation | The SAML Web SSO Version 2.0 endpoint service is activated. |
Action | No Action is required. |
Explanation | The indicated URL is not a valid SP endpoint. This could be caused by an incorrect configuration in the SP. |
Action | Make sure the SP is configured properly. |
Explanation | The indicated URL is not a valid SP endpoint. This could be caused by an incorrect configuration in the SP. |
Action | Make sure the SP is configured properly. |
Explanation | The indicated SP ID is not configured in the server.xml file or is not enabled. |
Action | Check the server.xml file to see if the provider ID is configured and that all its settings are correct. |
Explanation | A SAML Web Single Sign-On request has been received by the server, but the samlWeb-2.0 feature is not enabled in server.xml or it is not available. |
Action | Ensure the samlWeb-2.0 feature and its dependencies are configured in the featureManager of the server.xml file. |
Explanation | The id attribute for SAML Web SSO service providers uniquely identifies each service provider. The id attribute is used to construct information required for proper SAML Web SSO operation, such as the generation of valid service provider URLs. |
Action | Check the server.xml file to ensure that all SAML Web SSO service providers have been configured with a non-empty id attribute value. |
Explanation | While processing a SAML Web SSO request, an internal server error occurred. |
Action | Check for errors in the server log files and ensure your configuration is correct. If the problem persists, see the problem determination information on the WebSphere Application Server Support web page: http://www.ibm.com/software/webservers/appserv/was/support. |
Explanation | The IdP appears to have a problem issuing a SAML response. The reason for the issue appears in the message. |
Action | Review the Status code and the optional messages and make sure the Identity Provider and this Service Provider are configured properly. |
Explanation | The SAML response issued by the indicated IdP must contain an assertion. The SAML response received from the IdP does not contain an assertion. This condition is not allowed. |
Action | Ensure that the IdP is configured properly and the user has properly logged in to the IdP. |
Explanation | The SAML response contains an assertion version that is not supported by the service provider. The supported version is shown in the message. |
Action | Make sure the IdP is configured for version 2.0 assertion. |
Explanation | The SAML response is issued outside of an acceptable time period. A possible reason for the error is that the receiver's clock is out of sync with the clock of the creator of the assertion. |
Action | Make sure the date and time on the IdP is synchronized with this SAML Web Single Sign-On (SSO) service provider or increase the clock skew. |
Explanation | The destination in the SAML response must match the URL of the service provider. |
Action | Contact the IdP administrator to make sure the IdP is configured properly. |
Explanation | A valid SAML Assertion needs to be set to the indicated header in the HTTP Request. |
Action | Make sure the rsSaml configuration specifies a correct headerName and a valid SAML Assertion is set to that specified header in the HTTP request. |
Explanation | The custom post-logout URL value is not valid, so the page cannot be displayed. The value likely contains characters that are not valid for URI paths, such as spaces or fragment characters. |
Action | Ensure that the custom post-logout URL value contains only characters that can be used in URI paths. |
Explanation | The SAML Web SSO Version 2.0 configuration has been successfully deactivated. |
Action | No action is required. |
Explanation | The service provider (SP) cannot decode or parse SAML response message. Causes of this failure include incorrect encoding by the IdP, incorrect schema, or communication failure. |
Action | Contact the SAML IdP administrator. |
Explanation | The indicated metadata does not exist in the configuration. The SAML assertion cannot be validated without the metadata. |
Action | Make sure the metadata file for the IdP contains the instance of the indicated issuer. |
Explanation | The indicated metadata file cannot be processed. The reason for the error appears in the message. |
Action | Make sure the metadata file is in the right XML format and namespace. Also, refer to the user action for the cause shown in the message. |
Explanation | The indicated IdP metadata file does not exist or cannot be accessed. |
Action | Make sure the metadata file of the IdP exists and is accessable. |
Explanation | The identity provider (IdP) must respond with a SAMLResponse message. |
Action | Make sure the IdP is configured properly. |
Explanation | One of the following may have happened: 1) The SAML response was used more than once. 2) The response from the IdP took too long and the relay state was deleted from the SP. 3) The IdP altered the relay state that was sent to it. |
Action | Ensure that the IdP is sending responses only once, the responses are sent in a timely manner and it is not altering the relay state. |
Explanation | The protected resource cannot be accessed because of an internal error. The cached data may have been already accessed and removed. |
Action | Check the server logs for additional information. |
Explanation | The indicated file either does not exist or is not accessible. The reason for the error is displayed in the message. |
Action | Ensure that the file exists and that the application has access to the file. Also, refer to the user action for the cause of the error. |
Explanation | The Idp Metadata file has been updated with new configuration data for the IdP; the service provider (SP) will reload the file. |
Action | No action is required. |
Explanation | The unsolicted SAML response contains an InResponseTo attribute. This condition is not allowed. |
Action | Contact the IdP administrator to make sure the IdP is configured properly. |
Explanation | RelayState is a parameter of the SAML protocol that is used to identify the specific resource the user/user agent will access after they are signed in. If this information is missing, then SP does not know where to redirect the user/user agent. |
Action | Contact the IdP administrator to make sure the IdP is configured properly to include the RelayState in the SAML response. |
Explanation | The SAML assertion has an Issuer element with a Format attribute value that is not supported. The Format attribute must be omitted or set to a supported value. |
Action | Contact the IdP administrator to make sure the IdP is configured properly. |
Explanation | The SAML assertion must contain an Issuer element that matches the issuer defined in the IdP metadata file. The Issuer in the SAML assertion does not match the one in the metadata file. |
Action | Contact the IdP administrator to make sure the IdP is configured properly. |
Explanation | The SAML response message contains a signature, but the runtime cannot verify it because of an internal error. |
Action | Make sure the identity provider's (IdP) metadata is up-to-date. |
Explanation | The SAML assertion contains a signature, but the runtime cannot verify it because of an internal error. |
Action | Make sure the identity provider's (IdP) metadata is up-to-date. |
Explanation | The SAML assertion contains a signature that is not valid, or it is signed with an untrusted signer certificate. The reason for the error is displayed in the message. |
Action | This could be a configuration error, and make sure the identity provider's (IdP) metadata is properly updated and configured. Also, see the user action for the reason of the error displayed in the message. |
Explanation | The SAML assertion is missing an element required by the run time. |
Action | The required element must be added to the SAML assertion. Contact the identity provider (IdP) administrator to make sure the IdP is configured properly. |
Explanation | The SubjectConfirmationData element in the SAML assertion must not contain a NotBefore attribute. |
Action | Contact the identity provider (IdP) administrator to make sure the IdP is configured properly. |
Explanation | The SAML assertion has an element that is missing an attribute required by the run time. |
Action | The required attribute must be added to the SAML assertion. Contact the identity provider (IdP) administrator to make sure the IdP is configured properly. |
Explanation | The SAML assertion was received at a time that is at or after the NotOnOrAfter setting on the SubjectConfirmationData in the assertion. This condition is not allowed. A possible reason for the error is that the receiver's clock is out of sync with the clock of the creator of the assertion |
Action | Synchronize the clocks of the SAML service provider (SP) and identity provider (IdP) or increase the clock skew setting. |
Explanation | The Recipient attribute on the SubjectConfirmationData element must be set to the ACS URL. |
Action | Contact the identity provider (IdP) administrator to make sure the IdP is configured properly. |
Explanation | The SAML assertion was received at a time that is earlier than the NotBefore setting in the assertion. This condition is not allowed. A possible reason for the error is that the receiver's clock is out of sync with the clock of the creator of the assertion. |
Action | Synchronize the clocks of the SAML service provider (SP) and identity provider (IdP) or increase the clock skew setting. |
Explanation | The SAML assertion was received at a time that is at or after the NotOnOrAfter setting in the assertion. This condition is not allowed. Possible reasons for the error are that the receiver's clock is out of sync with the clock of the creator of the assertion or the assertion has been obtained and resent by an unauthorized application. |
Action | Synchronize the clocks of the SAML service provider (SP) and identity provider (IdP) or increase the clock skew setting. |
Explanation | The Conditions element in the SAML assertion contains an attribute that is not supported by the runtime. This condition is not allowed. |
Action | Contact the IdP administrator to make sure the IdP is configured properly. |
Explanation | The value of the Audience element must be set to the EntityID of the SP. |
Action | Contact the identity provider (IdP) administrator to make sure the IdP is configured properly. |
Explanation | The SAML assertion was received at a time that is at or after the SessionNotOnOrAfter setting in the AuthnStatement in the assertion. This condition is not allowed. Possible reasons for the error are that the receiver's clock is out of sync with the clock of the creator of the assertion or the assertion has been obtained and resent by an unauthorized application. |
Action | Synchronize the clocks of the SAML service provider (SP) and identity provider (IdP) or increase the clock skew setting. |
Explanation | The authentication process is not successful because some other error has happened prior to this message. |
Action | See the user action for the error that appears before this message. |
Explanation | The indicated SAML response has an invalid InResponseTo attribute value. |
Action | Contact the IdP administrator to make sure the IdP is configured properly, so it can emit a correct InResponseTo attribute value. |
Explanation | The SAML assertion is missing an attribute required by the run time. |
Action | The required attribute must be added to the SAML assertion. Contact the identity provider (IdP) administrator to make sure the IdP is configured properly or configure the service provider (SP) or the TAI to define a value for the attribute. |
Explanation | The indicated user either is not in the user registry or the configuration is not correct. |
Action | Make sure the user is configured in the user registry and also set up the Identity Provider and Service Provider properly. |
Explanation | The specified keystore does not have the required private key. |
Action | Make sure the configured keystore has the required keys or change the configuration to specify another keystore. |
Explanation | The specified keystore does not have the required signature certificate. |
Action | Make sure the configured keystore has the required certificate or change the configuration to specify another keystore. |
Explanation | The authFilter specified by the authFilterRef in the SAML WebSSO configuration does not exist. |
Action | Make sure the required authFilter configuration exists in the server or remove the authFilterRef element from the SAML WebSSO configuration. |
Explanation | The UserCredentialResolver service provided by the user feature can not map the SAML Assertion properly and throws a UserIdentityException. |
Action | Make sure the UserCredentialResolver service is properly set up if the UserIdentityException is not expected. |
Explanation | The request should not meet the filter criteria of more than one authFilter element. It should satisfy the conditions of only one authFilter, so the run time can choose the correct service provider to process. |
Action | Check the server configuration and fine-tune the authnFilter elements, so the conditions of one authFilter element are met and the request will be processed by the service provider that references the authFilter element. |
Explanation | The specified OSGi service is not available. |
Action | Restart the server with the "clean" option. |
Explanation | The IdP metadata file is missing the URL information. |
Action | Make sure the IdP metadata file content is accurate. |
Explanation | The SP does not have information regarding the IdP metadata. This might be due to 1) The idpMetadata attribute is not set properly 2) The file specified by the attribute does not exist. |
Action | Make sure that if the idpMetadata attribute is set, then the file referenced by the attribute exists. |
Explanation | The identity provider (IdP) may not have processed the SAML request in a timely manner. Check the IdP logs to make sure that the IdP is functioning correctly. |
Action | Submit the request again and also increase the value for the authnRequestTime attribute to make sure that the IdP has enough time to process the SAML request. |
Explanation | The SAML response from the identity provider (IdP) contains a SAML assertion that has already been included in a previous SAML response. |
Action | Ensure the identity provider (IdP) does not generate a duplicate SAML assertion ID or sends the same SAML assertion more than once. |
Explanation | The SAML WebSSO service provider (SP) requires the SAML WebSSO request to use HTTPS, but HTTP was used in the request URL. |
Action | Do one of the following: 1) Ensure that the SAML WebSSO service provider supports SSL. 2) If the SAML WebSSO service provider does not support SSL, set httpsRequired in the SAML WebSSO service provider configuration to false. |
Explanation | The SAML WebSSO service provider (SP) requires SSL communication, but HTTP was used in the IdP URL. |
Action | Do one of the following: 1) Ensure that the SAML WebSSO identity provider supports SSL. 2) If the SAML WebSSO identity provider does not support SSL, set httpsRequired in the SAML WebSSO service provider configuration to false. |
Explanation | Only SAML Assertion is supported for the content of the indicated header in the HTTP request. |
Action | Make sure the SAML Assertion is in the content of the indicated header. |
Explanation | While processing a SAML Web SSO inbound propagation request, an internal server error occurred. |
Action | Check for errors in the server log files and ensure your configuration is correct. If the problem persists, see the problem determination information on the WebSphere Application Server Support web page: http://www.ibm.com/software/webservers/appserv/was/support. |
Explanation | The trustedIssuers in the pkixTrustEngine is only in use by the SAML Web SSO feature. It is ignored in the SAML Web SSO for the inbound propagation feature. |
Action | Remove the trustedIssuers from the pkixTrustEngine. |
Explanation | The samlWebSso20 configuration is set to process either the inbound propagation of SAML token or SAML Web SSO, but not both. The listed attributes are ignored when handling web requests with the specified SAML configuration. |
Action | No action is required. |
Explanation | The SAML Assertion, which is contained in the header of the HTTP request, is not valid and can not be parsed properly. |
Action | Make sure a valid SAML Assertion is generated properly. |
Explanation | The service encountered an error when it processed the request as either a logout endpoint request, a logout response from an identity provider (IdP), or a logout request from an IdP. The message includes information about the type of request and more details about the error. |
Action | See the user action for the error that is displayed in the message. Check the server logs for any additional error messages. |
Explanation | The SAML Single Logout service cannot find the Single Sign-On (SSO) service for the SAML provider (SP) that is specified in the request. The SP might be disabled or might be missing from the server configuration. |
Action | Ensure that a SAML provider (SP) that matches the specified provider name is configured and enabled. Check the server logs for any additional error messages. |
Explanation | SAML SSO information must be included to process the SAML Single Logout request. A SAML provider (SP) might not be configured, or might not be configured to handle the request. |
Action | Ensure that at least one SAML provider (SP) is configured, or that there is at least one SP configured to process this request. |
Explanation | The SAML Single Sign-On (SSO) service might have encountered an error while submitting the SAML logout request or while processing the SAML logout response. |
Action | Check the server logs for any additional error messages. Ensure that the SAML SSO service did not encounter any other errors. |
Explanation | The Single Logout Service Endpoint URL of the Identity Provider (IdP) could not be obtained from the IdP metadata. |
Action | Check that the IdP metadata contains a SingleLogoutService entry with an HTTP-POST binding and a location that specifies a valid URL. |
Explanation | There are multiple service provider instances configured in Liberty server. The Liberty server cannot locate one unique service provider to initiate the SAML Single Logout. Only the user security session in the service providers are deleted. |
Action | Make sure that the logout application is associated with only one service provider. For example, one service provider per application . |
Explanation | The service provider cannot locate the user security session to create the SAML Single logout request message. The user was logged out from the service provider, but might still have an active security session with the Identity Provider (IdP). |
Action | Consider implementing the Identity Provider (IdP) initiated logout and redirect the user to the Identity Provider (IdP) to logout, especially if the service provider logout fails or is not complete. |
Explanation | There was an error extracting the SAML token from the subject or a SAML element was not found in the current subject. |
Action | If you create the run-as subject, make sure that the SAML token is added to the subject. Otherwise ensure that your server configuration supports adding the SAML token to the subject by checking the includeTokenInSubject attribute in your SAML configuration. |
Explanation | An exception occurred while extracting the SAML token from the subject. |
Action | Check the server logs for more information about the error. |
Explanation | The value for this configuration attribute must not be empty. |
Action | Ensure that the value for this configuration attribute is not empty, or remove the configuration attribute to use the default value. |
Explanation | Information about the authenticated user cannot be obtained because another error occurred. |
Action | If the message contains another error message, see the user action for that message. Otherwise, check the server logs for more error messages that might indicate where the other error occurred. |
Explanation | An access token is required to retrieve information about the authenticated user. The token endpoint of the OAuth provider must return the access token. |
Action | Verify that the token endpoint of the OAuth provider returned the access token. |
Explanation | The Kubernetes user API did not return the expected status code. |
Action | Check the API response that is in the error message for more information. Verify that the request to the API contains all of the required information. Ensure that the Kubernetes service account token was created with the correct permissions. |
Explanation | The key that is specified in the message is expected to be within the API response. The key might be missing, or it might be in an unexpected location. |
Action | Check the API response to determine whether the key is missing from the response. |
Explanation | The social login configuration that is specified in the message requires that all incoming requests must contain an access token. |
Action | If an access token header name is configured in the social login configuration, verify that the header is included in the request. Otherwise, verify that an Authorization header is included in the request. Ensure that the header value conforms to the OAuth bearer token specification. Verify that the OAuth provider is configured to pass an access token. |
Explanation | The header that is specified in the message might be missing from the request, or the value of the header might be empty. |
Action | Verify that the specified header is present in the request. Verify that the value of the header conforms to the OAuth bearer token specification. |
Explanation | The response from the Kubernetes user API cannot be read. The social login feature encountered an error when it tried to communicate with the user API, or the body of the response from the user API is empty. |
Action | Verify that the response from the user API is not empty and that the connection to the user API was successful. Check the server logs to determine whether an error occurred when the social login feature tried to communicate with the user API. |
Explanation | The response from the Kubernetes user API is expected to be a valid JSON object that contains information about the authenticated user. |
Action | Verify that the user API value in the social login configuration is set to a valid Kubernetes user API URL. Check the response from the user API to see whether more information is included. |
Explanation | The value for the specified key did not have the correct type. The response from the user API might be malformed, or the user API returned a response with an unexpected structure. |
Action | Check the structure of the response from the user API. Check the response from the user API to see whether an error occurred. |
Explanation | The response from the Kubernetes user API contains an error. The access token might not be valid, or some other error occurred while processing the token. |
Action | Check the error that is displayed in the message. Ensure that the access token is valid and is not malformed. |
Explanation | The user API response does not contain a key that corresponds to the value of the configuration attribute that is specified in the message. The social login feature attempts to use a different key instead. |
Action | Verify that the configuration attribute that is specified in the message is configured correctly. Ensure that the value of the configuration attribute corresponds to the entry in the user API response that should be used as the username. |
Explanation | Information about the service account cannot be obtained because another error occurred. |
Action | If the message contains another error message, see the user action for that message. Otherwise, check the server logs for more error messages that might indicate where the other error occurred. |
Explanation | The user API did not return the expected status code. The request might be missing information, or the request might not be authorized. |
Action | Check the API response that is in the error message for more information. Verify that the request to the API contains all required information. Verify that all tokens that are included in the request are valid. |
Explanation | The response must be a valid JSON object. |
Action | Verify that request was sent to the expected target. Ensure that the intended target of the request is capable of returning JSON data. Check the response to see whether more information is included. |
Explanation | The key that is specified in the message must be within the JSON data. The key might be missing, or it might be in an unexpected location. |
Action | Check the JSON data to determine whether the key is missing. |
Explanation | The value for the specified key did not have the correct type. The JSON data might be malformed or might have an unexpected structure. |
Action | Check the structure of the JSON data. Check the JSON data to see whether an error occurred. |
Explanation | Information about the authenticated user cannot be obtained because another error occurred. |
Action | If the message contains another error message, see the user action for that message. Otherwise, check the server logs for more error messages that might indicate where the other error occurred. |
Explanation | The authorization server did not issue the token, the resource owner revoked the token, the token is expired, or another error occurred. |
Action | Check the response that is included in the message. Verify that the correct token introspection endpoint is used. Verify that the token is valid and that the token can be introspected. |
Explanation | The access token that is in the user API request might be missing, expired, malformed, or otherwise not valid. The token might not be associated with a user that is known to the user API. |
Action | Verify that an access token is included in the user API request. Ensure that the token is not expired or malformed. Verify that the user that is associated with the access token is known to the user API. |
Explanation | The social login runtime code did not find a required parameter when processing the client request. |
Action | Check the missing parameter in the configuration and make sure that it is specified and correct. |
Explanation | The oidcLogin configuration is configured to discover the OpenID Connect provider endpoints through the discovery URL, but the discovery process failed. The client is unable to process the authentication requests until the configuration of the discoveryEndpoint is corrected or the discovery is successful. |
Action | Correct the oidcLogin configuration to ensure that 1) the discovery endpoint URL refers to the correct OpenID Connect provider, 2) the discovery endpoint URL is HTTPS and 3) the SSL feature and keystore elements are configured correctly with trust for OpenID Connect provider 4) ensure that the OpenID Connect provider discovery endpoint is functional. |
Explanation | The indicated social login configuration has been successfully processed. |
Action | No action is required. |
Explanation | The indicated social login configuration has been successfully processed. |
Action | No action is required. |
Explanation | The indicated social login configuration has been successfully deactivated. |
Action | No action is required. |
Explanation | While processing a social login request, an internal server error occurred. |
Action | Check for errors in the server log files and ensure your configuration is correct. If the problem persists, see the problem determination information on the WebSphere Application Server Support web page: http://www.ibm.com/software/webservers/appserv/was/support. |
Explanation | The authentication process was not successful because some other error has happened prior to this message. |
Action | See the user action for the error that appears before this message. |
Explanation | The request includes a 'social_login_hint' parameter or header that specifies a social login configuration ID to use for this request. However a social login configuration that matches the ID is missing, or the authentication filter that is used for the social login configuration is not configured to serve this request. |
Action | Verify that a social login service with the indicated ID is configured. If an authentication filter is configured for the social login service, verify that the filter is configured to serve the request. |
Explanation | The indicated URL is not a valid social login endpoint. This could be caused by an incorrect configuration in the social login server. |
Action | Make sure the social login is configured properly. |
Explanation | The Social Login Version 1.0 endpoint service is activated. |
Action | No Action is required. |
Explanation | A social login request has been received by the server, but the socialLogin-1.0 feature is not enabled in server.xml or it is not available. |
Action | Ensure the ssocialLogin-1.0 feature and its dependencies are configured in the featureManager of the server.xml file. |
Explanation | Authorized Twitter requests must be signed using the HMAC-SHA1 signature algorithm. Either there was an issue obtaining the required signature algorithm, or the provided key could not be used to initialize the signature algorithm. |
Action | Verify that your system supports the HMAC-SHA1 signature algorithm. Verify the consumer secret and request token secret values. These two values are used as part of the key for the signature algorithm. If either value is malformed or contains characters that cannot be encoded in compliance with RFC 3986, you may need to obtain a new value. |
Explanation | The response from the Twitter endpoint was likely null or empty. The initial request might have been directed to the wrong endpoint. Responses from Twitter endpoints should be a string of key and value pairs. The key and value are expected to be separated by an equal sign ("=") character, and multiple key and value pairs are expected to be separated by an ampersand ("&") character. |
Action | Verify that the request was directed to the correct Twitter endpoint. Verify that all required parameters were included in the initial request and that the request was authorized by including a valid Authorization header. A valid Authorization header is created using the consumer key for the Twitter application in addition to a callback URL or an OAuth request token. Check your server configuration to make sure that the correct consumer key and callback URL are configured. |
Explanation | The responses from each Twitter endpoint return their own set of parameters. The Twitter response received did not contain the required parameters that are listed in the message. The initial request might have been directed to the wrong endpoint. |
Action | Verify that the request was directed to the correct Twitter endpoint. Verify that all required parameters were included in the initial request and that the request was authorized by including a valid Authorization header. A valid Authorization header is created using the consumer key for the Twitter application in addition to a callback URL or an OAuth request token. Check your server configuration to make sure that the correct consumer key and callback URL are configured. |
Explanation | The parameter that is specified in the message must have a value that matches the expected value. This is an unlikely scenario where Twitter successfully processed a request but returned an unexpected value for the parameter. |
Action | Check your server configuration to make sure the callback URL configured for this application points to a valid URL that Twitter can redirect a user to once authorization is granted. |
Explanation | The response from the Twitter endpoint contained the parameter specified in the message but did not provide a value for the parameter. |
Action | Verify that the response from the Twitter endpoint contained all of the expected parameters and values for those parameters. Verify that all required parameters were included in the initial request and that the request was authorized by including a valid Authorization header. A valid Authorization header is created using the consumer key for the Twitter application in addition to a callback URL or an OAuth request token. Check your server configuration to make sure that the correct consumer key and callback URL are configured. |
Explanation | The initial request might have been directed to the wrong Twitter endpoint, or there was an error processing the response from the endpoint. |
Action | Check the server logs for any other messages that might indicate a failure. Verify that the initial request was directed to the appropriate endpoint. |
Explanation | The initial request likely contained incorrect authorization data or was forbidden from performing the requested operation. Twitter endpoints that require authorization must have an Authorization header that matches a specific format. For authorized requests, it is likely that a piece of data used to create the Authorization header, such as the signature or OAuth token, was malformed or incorrect. The status code provided in the message should indicate a more specific reason for why the request failed. |
Action | If the request was unauthorized, verify that the request contained an Authorization header with accurate authorization data. If the authorization data includes an OAuth token, verify that the token is still valid or consider obtaining a new token. Verify that the request is not identical to a previous request by comparing the signatures in the Authorization headers of the requests. If the request was forbidden, verify that the Twitter application allows the requested operation. |
Explanation | The specified parameter is required for OAuth authentication. The request that is being directed to the specified endpoint might fail because information that is required is missing. |
Action | Verify that the configuration attribute that corresponds to the specified parameter is configured by each social login provider in the server configuration. |
Explanation | The string specified in the message might not be a valid URI, or the system might not have permission to perform the action of initializing a URI. |
Action | Verify that the specified string is a valid URL. Verify that the string is not null and that the protocol used in the URL is a valid protocol such as http or https. Make sure that the code base has adequate permission to initialize a URI object. |
Explanation | One of the following situations likely occurred: 1. There was an error opening a connection to the specified endpoint. 2. The request method used for the request was not a known protocol such as GET or POST. 3. There was an error writing POST data to the connection. 4. There was an error reading the response from the Twitter endpoint. |
Action | See the error text in the message for more information about the failure. Verify that system maintained connectivity during the request. Verify that a known request method, such as GET or POST, was used for the request. |
Explanation | Either no result was returned or an empty result was returned from the specified request. An error must have occurred while submitting or processing the request. |
Action | Check the server logs for additional error messages that indicate where the failure occurred. |
Explanation | The URL to which the response was redirected might not have been valid or was unable to serve the request. |
Action | Verify that the redirect target is available and able to serve the request. See the error message for more information about the failure. |
Explanation | The inbound request must include an OAuth request token value that is identical to the OAuth request token that was obtained in the first step of the authorization process. The values must match to confirm that the inbound request corresponds to the initial request that began the authorization process. |
Action | Verify that the inbound request corresponds to an earlier request for an OAuth request token. Consider beginning the authorization flow again to obtain a new OAuth request token. |
Explanation | The request must contain all of the parameters shown in the message. The request did not contain any of the parameters shown in the message. |
Action | Verify that the request includes all required parameters. |
Explanation | A response status field is expected to determine the result of the authorization request. |
Action | Check the server logs for additional error messages that indicate where another error occurred. |
Explanation | The response status included in the result did not indicate a successful result. A failure must have occurred while submitting or processing the request. |
Action | If the message contains another error message, see the user action for that message. Otherwise, check the server logs for additional error messages that might indicate where another error occurred. |
Explanation | When more than one social login service are qualified, cannot select which social login service to handle the request. |
Action | Make sure no more than one social login service in the server.xml is configured to handle the request. |
Explanation | The specified endpoint might not be functioning as expected, or the endpoint behavior might have changed to return responses in a different format. Some data could have been omitted when reading the response. |
Action | Verify that the server read the entire response from the specified endpoint. Verify that the request was sent to the correct Twitter endpoint and that the response is formatted as expected. |
Explanation | At least one social login configuration must be present to display the sign in page. Either the cookie that contains the list of matching social login configurations is missing or empty, or the social login configurations specified by the cookie cannot be found. |
Action | Ensure that at least one social login service is configured to authenticate this request. |
Explanation | The specified ID is included in a cookie that is used to record which social login configurations are configured to authenticate this request. However, a social login configuration that matches that ID cannot be found. The ID is either malformed or the corresponding social login configuration has been removed. |
Action | Verify that a social login configuration with the specified ID is present in the server configuration. |
Explanation | An error occurred while processing the default sign in page. The message includes a specific explanation for why the sign in page cannot be displayed. |
Action | See the user action for the error that is displayed in the message. Check the server logs for any additional error messages. |
Explanation | The selection page URL that is configured by the social login web application configuration is not a valid URI string. The selection page URL must conform to RFC 3986 (https://tools.ietf.org/html/rfc3986) and can only contain certain characters. |
Action | Verify that the configured selection page URL is not null and contains only those characters allowed by RFC 3986. |
Explanation | The social media selection page URL value must be a relative path or a URL that uses the HTTP or HTTPS scheme. The provided URL is either null or uses a URL scheme other than HTTP or HTTPS. |
Action | Ensure that the social media selection page URL value is a relative path, or that the URL value uses the HTTP or HTTPS scheme. |
Explanation | The social login web application service is not available. The web application configuration is likely missing from the server configuration. |
Action | Verify that a social login web application configuration is specified in the server configuration. Check the server logs to ensure that the web application service is ready and available. |
Explanation | The request is expected to be sent to an endpoint that includes a social login configuration ID in the URL. However the URL does not include the ID of a known social login configuration. |
Action | Verify that the redirect URL is a well-formed URL that includes the ID of a social login configuration that exists in the server configuration. |
Explanation | A social media provider redirected a request to this endpoint to continue authenticating or authorizing a user. However, the request cannot be completed because of the reason that is displayed in the error message. |
Action | See the user action for the error that is displayed in the message. Check the server logs for any additional error messages. |
Explanation | The attribute that defines the user name varies by social media platform. The value that is configured for userNameAttribute might be incorrect. |
Action | Verify that the value of the userNameAttribute matches the value used by the social media platform to define the user name. |
Explanation | The attribute that defines the realm name varies by social media platform. The value that is configured for the realmName attribute might be incorrect. |
Action | Verify that the value of the realmName attribute matches the value used by the social media platform to define the realm. |
Explanation | Some of the profile information that was used to create the subject for the user might be missing or malformed. |
Action | See the user action for the error that is displayed in the message. Check the server logs for any additional error messages. |
Explanation | An error occurred while the feature was using one of the encryption algorithms to create an encrypted access token based on the access token that was provided. The message should include a more specific reason why the encrypted token cannot be created. |
Action | See the user action for the error that is displayed in the message. Check the server logs for any additional error messages. |
Explanation | A null access token cannot be encrypted. |
Action | Provide a non-null access token to be encrypted. |
Explanation | The public key that is used to encrypt the access token might be malformed or might not be valid, or the required RSA encryption algorithm might not be available. |
Action | Verify that the public key that is configured for the specified social login configuration is valid and can be used for RSA encryption. |
Explanation | The secret key that is used to encrypt the access token might be malformed or might not be valid. An error might have occurred while getting the initialization vector for the encryption algorithm, or the required AES encryption algorithm might not be available. |
Action | Verify that the secret key that is configured for the social login configuration that is specified in the message is valid and can be used for AES encryption. |
Explanation | A state value is generated for each unique authentication request and stored in a cookie. That value is required to verify and process each authentication request. The state cookie either was not created or was deleted. |
Action | Verify that the state value was successfully stored in a cookie and that the cookie was not deleted. |
Explanation | The original request URL is stored in a cookie at the beginning of the authentication process. That cookie is either missing or its value is empty. |
Action | Verify that the original request URL was successfully stored in a cookie and that the cookie was not deleted. |
Explanation | An error occurred that prevented the RSA encryption algorithm from decrypting the access token. The private key that is used to decrypt the access token might be malformed or might not be valid, the encrypted token might not be formatted properly, or the required RSA encryption algorithm might not be available. |
Action | Verify that the social login configuration specifies a private key that has a valid configuration and can be used for RSA decryption. Verify that the encrypted token is formatted correctly and that the decryption algorithm is available. |
Explanation | An error occurred that prevented the AES encryption algorithm from decrypting the access token. The secret key that is used to decrypt the access token might be malformed or might not be valid. The encrypted token might not be formatted properly. An error might have occurred while retrieving the initialization vector for the decryption algorithm, or the required AES encryption algorithm might not be available. |
Action | Verify that the social login configuration specifies a secret key that has a valid configuration and can be used for AES decryption. Verify that the encrypted token is formatted correctly and that the decryption algorithm is available. |
Explanation | The value for an encrypted token is expected to be encoded in hexadecimal format. |
Action | Verify that the value is encoded correctly in hexadecimal format. |
Explanation | There was likely an error while building the authorization endpoint redirect URL. Alternatively, an error occurred while redirecting the request. |
Action | See the user action for the error that is displayed in the message. Verify that the redirect URL for the authorization endpoint is a valid URL. Check the server logs for any additional error messages. |
Explanation | A 'state' parameter is required in requests to OAuth authorization endpoints. A valid authorization endpoint request cannot be created without a state value. |
Action | Verify that a non-null state value was generated for this request. |
Explanation | A 'redirect_uri' parameter is required in requests to OAuth authorization endpoints. A valid authorization endpoint request cannot be created without a redirect URI value. |
Action | Verify that a non-null redirect URI value was created for this request. |
Explanation | The request includes an authorization code that is used to obtain user information from an OAuth token endpoint. SSL information is required to invoke the token endpoint. An error occurred while loading the SSL information, so the token endpoint cannot be invoked. |
Action | See the user action for the error that is displayed in the message. Verify that the specified social login configuration references a valid SSL configuration, or verify that the default SSL configuration for the server is properly configured. |
Explanation | The social login feature must make a request to the token endpoint to obtain an access token and an optional ID token. The token endpoint URL might be malformed or missing, the response from the token endpoint might not be formatted correctly, or there was an error calling the token endpoint. |
Action | Verify that the token endpoint URL that is configured for the specified social login configuration is a valid URL. Check the server logs for additional error messages. |
Explanation | User data must be returned from the configured user API. The user cannot be authenticated without user data from the user API. |
Action | Verify that at least one user API is configured for the specified social login configuration. Check the server logs for additional error messages. |
Explanation | An error might have occurred while getting user information with the provided access token, or an error might have occurred while building a JWT from the provided ID token. |
Action | See the user action for the error that is displayed in the message. Check the server logs for additional error messages. |
Explanation | Some of the data that is used to create the subject for the specified user might be missing or malformed. |
Action | See the user action for the error that is displayed in the message. Check the server logs for any additional error messages. |
Explanation | A subject cannot be created for the user because the access token is missing. The data that was returned from the social medium should include an access token. |
Action | Check the server logs for additional error messages. Verify that an access token was returned from the social medium. |
Explanation | A valid access token must be provided to retrieve the social login configuration that is associated with the access token. |
Action | Provide a valid access token to create a user profile. |
Explanation | The token key that is calculated might be malformed, or this access token was not used in a recent authenticated request. The token might have been removed from the cache because it was too old. |
Action | Ensure that the token that is provided is a valid access token and that it matches an access token that was used in a successfully authenticated request. Verify that the token cache has not been cleared since the token was added. |
Explanation | The social login service that is specified cannot be found in the server configuration. The social login configuration ID that is associated with the access token is either missing, or the social login configuration that is specified does not exist. |
Action | Ensure that a social login configuration with the ID that is specified exists in the server configuration. Verify that the social login configuration was successfully loaded. |
Explanation | An access token must be provided to create a user profile. The token might not be in the token cache, or the token might be missing from user information that was returned from the social medium. |
Action | Verify that an access token was included in the set of data that was returned from the social medium. Verify that the token object specified a valid access token at the time the token object was cached. |
Explanation | At least one user API configuration must be specified to obtain user information. |
Action | Ensure that the specified social login configuration contains at least one user API configuration. |
Explanation | The specified user API might not be configured correctly. There might be a problem with the access token that was used to invoke the user API. The response from the user API might not be in the expected format. |
Action | See the user action for the error that is displayed in the message. Check the server logs for any additional error messages. |
Explanation | A valid token endpoint URL must be provided to obtain access tokens or ID tokens for users. |
Action | Ensure that a valid token endpoint URL is configured for every social login configuration. |
Explanation | The SSL configuration that is used by the specified social login configuration might be missing or incorrect. |
Action | See the error in the message for more information. Verify that the SSL information for the specified social login configuration is accurate. If the 'sslRef' configuration attribute is specified in the social login configuration, verify that the corresponding SSL configuration is correct. Otherwise, verify that the default SSL configuration for the server is properly configured. |
Explanation | The specified social login configuration might not be available yet, or the service for the social login configuration has been stopped. |
Action | Verify that the specified social login configuration is configured and available. |
Explanation | The context path that is configured by the social login web application configuration is not a valid URI path string. The context path must conform to RFC 3986 (https://tools.ietf.org/html/rfc3986) and can only contain certain characters. |
Action | Verify that the configured context path contains only those characters allowed by RFC 3986 for URI path components. |
Explanation | The SSL configuration that is used by the social login configuration might not be available, or an error occurred loading the properties for the SSL configuration. |
Action | Verify that the SSL configuration used by the social login service is configured correctly and has started successfully. |
Explanation | The keystore service for the social login feature might not be available. |
Action | Verify that the keystore service that is used by the social login service is configured correctly and has started successfully. |
Explanation | The truststore might not be initialized yet, or the specified truststore does not exist in the server configuration. |
Action | Verify that a truststore with the specified ID is present in the server configuration and was successfully processed. |
Explanation | A certificate with the specified alias might not be present in the truststore, the truststore might not be initialized yet, or the truststore does not exist in the server configuration. |
Action | Verify that a certificate with the specified alias is included in the truststore. Verify that a truststore with the specified ID is present in the server configuration and was successfully processed. |
Explanation | The keystore service might not be available, the certificates in the truststore cannot be loaded, or the certificate with the specified alias cannot be loaded. |
Action | See the user action for the error that is displayed in the message. Check the server logs for any additional error messages. |
Explanation | A private key with the specified alias might not be present in the keystore, the private key might not be the correct type, the keystore might not be initialized yet, or the keystore does not exist in the server configuration. |
Action | Verify that a private key with the specified alias is included in the keystore and that the private key is the correct type. Verify that a keystore with the specified ID is present in the server configuration and was successfully processed. |
Explanation | The private key that was selected from the keystore might not be the correct type, the keystore might not be initialized yet, or the keystore does not exist in the server configuration. |
Action | Verify that the private keys in the keystore are the correct type. Verify that a keystore with the specified ID is present in the server configuration and was successfully processed. |
Explanation | A secret key with the specified alias might not be present in the keystore, the secret key might not be the correct type, the keystore might not be initialized yet, or the keystore does not exist in the server configuration. |
Action | Verify that a secret key with the specified alias is included in the keystore and that the secret key is the correct type. Verify that a keystore with the specified ID is present in the server configuration and was successfully processed. |
Explanation | The response from the social medium endpoint might not be in the expected format. An error might have occurred while executing the response, or the social medium might have returned an error. |
Action | Check the content of the response from the social medium. Verify that the response content is formatted correctly and that the response did not include an error message. |
Explanation | An HTTP request cannot be made with a null or empty URL. An endpoint URL in the social login configuration might be missing or empty. |
Action | Verify that every endpoint URL that is specified in a social login configuration has a value that is a valid URL. |
Explanation | The provided URL might be malformed or contain a protocol that is not valid, or an error might have prevented the request from being served. |
Action | See the message for a more detailed error description. Verify that the URL is a well-formed URL and that there were no connection issues with the target server. |
Explanation | The request likely failed because it was unauthorized or missing information such as a required request parameter or header. If the response status was not null, the response status code and reason is included in the message. |
Action | Check the response status code in the message, if present. Verify that all required parameters and headers were included in the request. |
Explanation | The request likely failed because it was unauthorized or missing information such as a required request parameter or header. The request might have been directed to the wrong endpoint. |
Action | Verify that the request was directed to the correct endpoint. Verify that all required parameters and headers were included in the request. |
Explanation | The specified configuration attribute might be missing from the server configuration. If a value is specified, white space at the beginning and end of the value is removed when the value is processed, so the value in the configuration might be empty or consist of only white space characters. |
Action | Ensure that the specified configuration attribute is configured, that it is not empty, and that it does not consist of only white space characters. |
Explanation | An empty or missing state element in a social login request caused an error. |
Action | Verify that the social login configuration is correct and the remote service is operating correctly. |
Explanation | An empty or missing request URL attribute in the social login request caused an error. |
Action | Verify that the social login configuration for the URL attribute is correct and the remote service is operating correctly. |
Explanation | The value for the specified configuration attribute is not a valid URL. A valid URL must be specified that can serve requests for Twitter request tokens. |
Action | Ensure that a valid URL is configured for the specified configuration attribute, and that the URL is capable of serving requests for Twitter request tokens. To use the default Twitter endpoint, remove the specified configuration attribute from the Twitter configuration that is specified in the message. |
Explanation | The value for the specified configuration attribute is not a valid URL. A valid URL must be specified that can serve requests for Twitter access tokens. |
Action | Ensure that a valid URL is configured for the specified configuration attribute, and that the URL is capable of serving requests for Twitter access tokens. To use the default Twitter endpoint, remove the specified configuration attribute from the Twitter configuration that is specified in the message. |
Explanation | The value for the specified configuration attribute is not a valid URL. A valid URL must be specified that can serve requests for Twitter user account data. |
Action | Ensure that a valid URL is configured for the specified configuration attribute, and that the URL is capable of serving requests for Twitter user account data. To use the default Twitter endpoint, remove the specified configuration attribute from the Twitter configuration that is specified in the message. |
Explanation | The configuration attribute that is specified in the message is missing from the configuration, or the value for the attribute is empty or consists of only white space characters. A non-empty value for this attribute is required. |
Action | Verify that all Twitter social login elements in the server configuration have configured the attribute that is specified in the message and that their values are not empty. |
Explanation | The request might be directed to an incorrect endpoint, or the request does not include enough information. |
Action | Verify that the endpoint URL is accurate and that the request included all of the necessary headers or parameters. Check the server logs for additional error messages. |
Explanation | The specified endpoint might not be active, or the endpoint might return responses in a different format. |
Action | Verify that the server read the entire response from the specified endpoint. Verify that the request was sent to the correct endpoint and that the response is formatted as expected. |
Explanation | The endpoint value that is specified in the message is not considered a valid URI because it contains characters that are not valid. The set of valid URI characters is defined by RFC 3986. |
Action | Update the URI string to contain only valid URI characters. |
Explanation | A problem occurred while authenticating a user. There might have been a connection issue between the application and a third-party service provider. |
Action | Contact the system administrator to resolve the problem. |
Explanation | The specified response status did not indicate a successful result. The error and error description provided in the message may contain additional information. |
Action | Take the action necessary to fix the error in the response. |
Explanation | The specified user API endpoint did not return a valid response status, and an error was encountered while processing the response. |
Action | Verify that the specified endpoint is correct and that it is a valid endpoint that is capable of processing user info API requests. |
Explanation | The specified user API endpoint returned a valid response status but the runtime encountered an error while processing the response content. |
Action | Verify that the specified endpoint is correct and the response content is formatted correctly. See the user action for the error that is displayed in the message. |
Explanation | The specified user API endpoint did not return a valid response to the user API request. |
Action | Verify that the specified endpoint is correct and that it is a valid endpoint that is capable of processing user info API requests. |
Explanation | An empty or missing CODE attribute in the the social login request caused an error. |
Action | Verify that the social login configuration for the social media service is correct and the remote service is operating correctly. |
Explanation | The specified response status indicated that the authentication was not successful. The error and error description provided in the message contain additional information. |
Action | Verify that social login is correctly configured in the server configuration, and verify that the values in the server configuration match the values that are defined in the remote social media. |
Explanation | The value is expected to be an HTTP URI, so the value needs to start with either http:// or https://. |
Action | Update the URI so that it specifies either the HTTP or HTTPS protocol. |
Explanation | The error that is displayed in the message should provide a more specific reason the JWT cannot be created. Either the user API request is malformed or missing information, an error occurred after the user API request was submitted, or the response from the user API cannot be used to create a JWT. |
Action | Verify that the user API value is correct. See the user action for the error that is displayed in the message. Check the server logs for any additional error messages. |
Explanation | The JWT configuration that is specified in the message might be configured incorrectly, the ID token might be malformed or missing information, or another error occurred while creating the JWT. |
Action | Verify that the JWT configuration that is specified in the message is configured correctly. See the user action for the error that is displayed in the message. Check the server logs for any additional error messages. |
Explanation | The original request URL is not a valid URL. The URL might include characters that are not valid, or the URL might be malformed. |
Action | Verify that the request URL that is specified in the message matches the original protected resource request URL. Verify that the URL is well-formed and contains only valid URI characters. |
Explanation | The indicated configuration was successfully processed. |
Action | No action is required. |
Explanation | The indicated configuration was successfully processed. |
Action | No action is required. |
Explanation | The indicated configuration was successfully deactivated. |
Action | No action is required. |
Explanation | The JWT string is likely malformed and cannot be parsed. |
Action | Verify that the JWT string is a valid JSON object. |
Explanation | The subject contains too many principals of type JsonWebToken. Only one principal of this type is supported. |
Action | Verify that the application does not inject additional JsonWebToken principals into the subject. |
Explanation | The request includes a parameter or header named mpjwt_login_hint that specifies a MicroProfile JWT configuration ID to use for this request. However a MicroProfile JWT configuration that matches the ID is missing or is not configured to serve this request. |
Action | Verify that a MicroProfile JWT service with the indicated ID is configured. |
Explanation | The token does not contain a claim that matches the value of the userNameAttribute configuration attribute, or the value that is specified by the userNameAttribute configuration attribute is incorrect. |
Action | Verify that the token contains a claim that matches the value of the userNameAttribute configuration attribute. |
Explanation | The provided JSON data is likely missing or malformed. |
Action | Verify that the provided JSON data is formatted as a valid JSON object. |
Explanation | Some of the data that is used to create the subject for the specified user might be missing or malformed. |
Action | See the user action for the error that is displayed in the message. Check the server logs for any additional error messages. |
Explanation | The value for the specified claim does not match the expected data type. |
Action | Verify that the specified claim exists and that its value is formatted correctly. |
Explanation | The SSL configuration that is used by the specified configuration might be missing or incorrect. |
Action | See the error in the message for more information. Verify that the SSL information for the specified configuration is accurate. If the sslRef configuration attribute is specified in the MicroProfile JWT configuration, verify that the corresponding SSL configuration is correct. Otherwise, verify that the default SSL configuration for the server is properly configured. |
Explanation | The specified MicroProfile JWT configuration might not be available yet, or the service for the configuration was stopped. |
Action | Verify that the specified configuration is configured and available. |
Explanation | The SSL configuration that is used by the MicroProfile JWT configuration is not available, or an error occurred loading the properties for the SSL configuration. |
Action | Verify that the SSL configuration used by the MicroProfile JWT service is configured correctly and has started successfully. |
Explanation | The keystore service for the MicroProfile JWT feature is not available. |
Action | Verify that the keystore service that is used by the MicroProfile JWT service is configured correctly and has started successfully. |
Explanation | The trust store service is not available or an error occurred while loading certificates from the trust store. |
Action | See the user action for the error that is displayed in the message. Check the server logs for any additional error messages. |
Explanation | Either the key specified by the keyAlias configuration attribute cannot be loaded, or an error was encountered while loading the first available public key. |
Action | See the user action for the error that is displayed in the message. Check the server logs for any additional error messages. |
Explanation | The specified trust store might not exist, or an error was encountered while getting trusted certificates from the trust store. |
Action | Verify that the specified trust store exists in the server configuration. Verify that the keystore service that is used by the MicroProfile JWT service is configured correctly and has started successfully. |
Explanation | The specified trust store either does not exist, or the trust store does not contain a certificate with the provided alias. |
Action | Verify that the specified trust store exists in the server configuration. Verify that the trust store contains a certificate with the specified alias. |
Explanation | An error was likely encountered while loading the public keys in the specified trust store. |
Action | See the user action for the error that is displayed in the message. Check the server logs for any additional error messages. |
Explanation | The specified claim is expected to be found in the authenticated user information, but the claim was not found. The user information might be missing or malformed, the specified configuration attribute might be missing or empty, or the specified claim is not present in the user information. |
Action | Do one of the following. 1) Specify a different claim as the value for the specified attribute in the MicroProfile JWT configuration. 2) Verify that the provider emits the authenticated user information with the specified claim. |
Explanation | The specified claim in the authenticated user information does not match the expected data type, so the claim value cannot be used for principal mapping. |
Action | Verify that the MicroProfile JWT configuration specifies the correct claim name for the specified configuration attribute. |
Explanation | The MicroProfile JWT feature cannot select a MicroProfile JWT service to handle the request when more than one service is qualified to handle the request. |
Action | Make sure that no more than one MicroProfile JWT service in the server configuration is configured to handle the request. |
Explanation | To perform authentication, a MicroProfile JWT must be included in either the Authorization header using the Bearer authorization scheme or as a POST parameter. The Authorization header is missing, the authorization scheme of the Authorization header is not set to Bearer, the request is not a POST request, or a MicroProfile JWT is not included as a parameter. |
Action | Ensure that a MicroProfile JWT is included in the Authorization header or as a POST parameter of the request. |
Explanation | The MicroProfile JWT feature encountered an error while creating a JWT from the provided token string. Either a JWT consumer cannot be created or the JWT consumer encountered an error while parsing and validating the token string. |
Action | See the user action for the error that is displayed in the message. Check the server logs for any additional error messages. |
Explanation | Either a JWT consumer cannot be created or the JWT consumer encountered an error while parsing and validating the token string. |
Action | Verify that the specified MicroProfile JWT configuration is present in the server configuration. Verify that the provided token string is formatted correctly. See the user action for the error that is displayed in the message. Check the server logs for any additional error messages. |
Explanation | A problem occurred while authenticating a user. There might have been a connection issue between the application and a third-party service provider, or a problem with authentication data. |
Action | Contact the system administrator to resolve the problem. |
Explanation | To perform authentication successfully, do one of the following. a) Make sure that the ignoreApplicationAuthMethod attribute is "true" b) loginConfig annotation is set to MP-JWT in the application. |
Action | Ensure that the server or application configuration is updated. |
Explanation | A previous HttpServletRequest.logout() call was made for a subject that was authenticated with this JWT. |
Action | Resubmit the request with a different JWT. |
Explanation | The MicroProfile Config property that is specified in the message has a predefined set of values that are supported. Other values are ignored, and the default value is used instead. |
Action | Specify one of the supported values for the property that is indicated in the message. |
Explanation | The injection point that is annotated with the Claim qualifier does not have a valid type. |
Action | Ensure that the injection point has a valid type for the claim you want to inject. |
Explanation | An injected claim did not resolve. |
Action | Check the server message and first-failure data capture (FFDC) logs to determine the cause. |
Explanation | The injection point annotated with the Claim qualifier has conflicting elements. |
Action | Ensure that the injection point has a valid Claim qualifier for the claim you want to inject. |
Explanation | The injection point annotated with the Claim qualifier for a raw type must belong to a class annotated with the RequestScoped scope annotation. |
Action | Ensure that the injection point is a member of a class in the RequestScoped scope for the claim you want to inject. |
Explanation | Injection of a JsonWebToken was requested, but one is not available. |
Action | Ensure that user authentication has occurred prior to accessing the resource that is requesting injection. |
Explanation | The indicated configuration processed successfully. |
Action | No action is required. |
Explanation | The indicated configuration processed successfully. |
Action | No action is required. |
Explanation | The indicated configuration deactivated successfully. |
Action | No action is required. |
Explanation | The indicated configuration processed successfully. |
Action | No action is required. |
Explanation | The indicated configuration processed successfully. |
Action | No action is required. |
Explanation | The indicated configuration deactivated successfully. |
Action | No action is required. |
Explanation | The indicated configuration was processed successfully. |
Action | No action is required. |
Explanation | The indicated configuration was processed successfully. |
Action | No action is required. |
Explanation | The indicated configuration was deactivated successfully. |
Action | No action is required. |
Explanation | An application server component could not perform an operation on a required resource. |
Action | Ensure that the specified file name is a valid file name. Ensure that the Application Server runtime is allowed write access to the directory for the resource, and that the disk is not full. If this does not solve the problem, see the problem determination information on the WebSphere Application Server Support Web page: http://www.ibm.com/software/webservers/appserv/was/support. |
Explanation | An attempt to open the specified resource failed. The exception indicates the root cause of the failure. |
Action | Examine the exception to determine the root cause. Ensure that the specified file name is a valid file name. Ensure that the Application Server runtime is allowed write access to the directory for the resource, and that the disk is not full. If this does not solve the problem, see the problem determination information on the WebSphere Application Server Support Web page: http://www.ibm.com/software/webservers/appserv/was/support. |
Explanation | An application server component could not perform an operation on a required resource. |
Action | Ensure that the specified file name is a valid file name. Ensure that the Application Server runtime is allowed write access to the directory for the resource, and that the disk is not full. If this does not solve the problem, see the problem determination information on the WebSphere Application Server Support Web page: http://www.ibm.com/software/webservers/appserv/was/support. |
Explanation | An attempt to delete the specified resource failed. The exception indicates the root cause of the failure. |
Action | Examine the exception to determine the root cause. Ensure that the Application Server runtime is allowed write access to the directory for the resource. If this does not solve the problem, see the problem determination information on the WebSphere Application Server Support Web page: http://www.ibm.com/software/webservers/appserv/was/support. |
Explanation | The audit file handler service is in the process of starting. This might take several minutes if one-time initialization needs to occur. |
Action | No action is required. |
Explanation | This message is for informational purposes only. |
Action | No action is required. |
Explanation | This message is for informational purposes only. |
Action | No action is required. |
Explanation | The audit service cannot start because of an error in the audit handler configuration for encrypting audit records. For more information, refer to the exception in the previous service activation failure message. Specify a valid keystore reference and make sure that the certificate alias refers to a certificate that is present in the keystore. |
Action | Ensure that the audit handler configuration specifies both a keystore reference and a certificate alias for encrypting audit records. Ensure that the keystore exists, the password is specified correctly, and that the keystore contains the certificate that is referenced by the encryption certificate alias. |
Explanation | The audit service cannot start because of an error in the audit handler configuration for signing audit records. For more information, refer to the exception in the previous service activation failure message. Specify a valid keystore reference and make sure that the personal certificate alias refers to a personal certificate that is present in the keystore. |
Action | Ensure that the audit handler configuration specifies both a keystore reference and a personal certificate alias for signing audit records. Ensure that the keystore exists, the password is specified correctly, and that the keystore contains the personal certificate that is referenced by the signing certificate alias. |
Explanation | The audit service cannot start because an error occurred during the initialization of the audit handler configuration for encrypting audit records. For more information, see the exception in the message. |
Action | Refer to the exception to determine the cause of the error. |
Explanation | The audit service cannot start because an error occurred during the initialization of the audit handler configuration for signing audit records. For more information, see the exception that is mentioned in the message. |
Action | Refer to the exception to determine the cause of the error. |
Explanation | The audit service is in the process of starting. This might take several minutes if one-time initialization needs to occur. |
Action | No action is required. |
Explanation | This message is for informational purposes only. |
Action | No action is required. |
Explanation | This message is for informational purposes only. |
Action | No action is required. |
Explanation | The audit event name provided in the event configuration is incorrect and the audit service will be stopped. Analyze the exception mentioned in the message and specify a valid audit event name. |
Action | Ensure that the audit event name provided as part of the event configuration is correct. |
Explanation | The audit outcome name provided in the event configuration is incorrect and the audit service will be stopped. Analyze the exception mentioned in the message and specify a valid audit outcome name. |
Action | Ensure that the audit outcome name provided as part of the event configuration is correct. |
Explanation | The audit event name that is specified in the event configuration is incorrect or missing, and the audit service will be stopped. Analyze the exception mentioned in the message and specify a valid audit event name. |
Action | Ensure that a valid event name is specified along with the valid outcome type. |
Explanation | The JWT (json web token builder) configuration has been successfully processed. |
Action | None |
Explanation | The JWT(json web token builder) configuration has been successfully modified. |
Action | None. |
Explanation | This message is for informational purposes only. |
Action | No action is required. |
Explanation | The JSON Web Token (JWT) service is not available through the OSGi service registry. |
Action | Include the jwt-1.0 feature in your server configuration. |
Explanation | The specified URL did not match the expected URL pattern of a request that is intended to be served by this filter. |
Action | Verify that the URL path points to the expected endpoint and that it matches an endpoint that is provided by the jwt-1.0 feature. |
Explanation | The provider specified in the message either does not exist in the server configuration, or the configuration for the specified provider has not been processed by the configuration service. |
Action | Inspect the server configuration to ensure that the specified provider is configured. |
Explanation | The request might not have been handled by the appropriate filter before the request was processed. The request filter will create the specified attribute based on information in the request. The filter then forwards that request for further processing. |
Action | Verify that the request was directed to the expected endpoint. |
Explanation | A signing key cannot be found, or a key that uses the configured signature algorithm cannot be found. This error might occur because of missing or inaccurate information in the JWT configuration. |
Action | Do one of the following actions: 1) If using JSON Web Key (JWK) to sign, ensure that RS256 is configured on the signatureAlgorithm attribute. 2) If using X.509 certificates to sign, ensure the signatureAlgorithm, KeyStoreRef, and KeyStoreAlias attributes are configured properly. 3) If using shared keys to sign, ensure the signatureAlgorithm and sharedKey attributes are configured properly. |
Explanation | A JSON web token (JWT) builder with the specified ID does not exist in the server configuration. |
Action | In the server.xml file, configure a jwtBuilder element with the specified ID. |
Explanation | The specified value in the JSON web token (JWT) claim does not meet the JWT specification. |
Action | Provide a valid value for the specified claim. For additional information, see the JWT specification. |
Explanation | The JSON Web Token (JWT) builder API was unable to create a valid builder object because the builder service is not available. |
Action | Ensure that you have the jwt-1.0 feature configured. |
Explanation | JSON Web Token builder did not alter the existing claims because the supplied claims map specifies null for either the claim name or the claim value. |
Action | Make sure to pass a valid claims map. |
Explanation | This message is for informational purposes only. |
Action | No action is required. |
Explanation | The JWT consumer service must be activated before it can be used. Either the service has not yet started, or the service has been deactivated by removing the jwt-1.0 feature. |
Action | Ensure that the jwt-1.0 feature is configured and that the JWT consumer service is ready to use. |
Explanation | A JWT consumer cannot be created using a null configuration ID. A valid ID must be specified in order to process the appropriate JWT consumer configuration. |
Action | Specify an ID that is not null and matches the ID of a JWT consumer that exists in your server configuration. |
Explanation | The specified claim is empty or null, so the JSON Web Token builder API cannot continue processing. |
Action | Ensure that a valid claim name is passed. |
Explanation | A signing key cannot be found, or a key that uses the configured signature algorithm cannot be found. This error might occur because of missing or inaccurate information in the JWT configuration. |
Action | Do one of the following actions: 1) If using JSON Web Key (JWK) to sign, ensure that RS256 is configured on the signatureAlgorithm attribute. 2) If JWK is not used, ensure the KeyStoreRef, and KeyStoreAlias attributes are configured properly for RS256. 3) If using shared keys to sign, ensure the signatureAlgorithm and sharedKey attributes are configured properly. |
Explanation | The specified token content is not valid, so the JSON Web Token builder API cannot continue processing. |
Action | Ensure that URLs that are configured for the relying party are valid. Ensure that valid content is passed for the token. For more information, see the API documentation. |
Explanation | The specified claim value is not valid, so the JSON Web Token builder API cannot continue processing. |
Action | Ensure that the value for the specified claim is a non-zero positive number. |
Explanation | The specified claim value is not valid for the specified claim, so the JSON Web Token builder API cannot continue processing. |
Action | Ensure that the claim value is the correct data type. For more information, see the API documentation. |
Explanation | The JSON Web Token builder API encountered an error that prevents the creation of the JWT. |
Action | See the user action for the error that appears before this message. |
Explanation | The provided claims are not valid, so the JSON Web Token builder API cannot continue processing. |
Action | Ensure that the correct set of claims are provided. For more information, see the API documentation. |
Explanation | The server configuration specifies which issuers are trusted when validating JWTs. The provided token did not originate from a trusted issuer, so the token cannot be validated. |
Action | Obtain a new token from one of the trusted issuers specified in your JWT configuration, or add the issuer specified in the message as a trusted issuer in your JWT configuration. |
Explanation | The server configuration specifies which audiences are trusted when validating JWTs. The provided token is not intended for a trusted audience, so the token cannot be validated. |
Action | Obtain a new token intended for one of the trusted audiences specified in your JWT configuration, or add the audience specified in the message as a trusted audience in your JWT configuration. |
Explanation | The JWT is not valid because it was issued after its own expiration date. |
Action | Obtain a new token with a valid 'iat' claim that specifies a time earlier than the time specified by the 'exp' claim. |
Explanation | Tokens that are expired or do not specify an 'exp' claim are not valid. |
Action | Obtain a new token that contains an 'exp' claim and is not expired. Synchronize the clock times between the token issuer and the consumer, or increase the clock skew in your JWT configuration. |
Explanation | The JWT has a 'nbf' (not-before) claim that specifies a time when the token becomes valid. The current time is before the 'nbf' time, so the token is not yet valid. |
Action | Wait until after the time specified by the 'nbf' claim before using this token, or obtain a new token with a 'nbf' claim set to a time before the current time. Synchronize the clock times between the token issuer and the consumer, or increase the clock skew in your JWT configuration. |
Explanation | The token is either malformed, not signed, or is missing signature information. Tokens are required to be signed by the specified algorithm. |
Action | Obtain a new token that is signed using the specified algorithm. |
Explanation | Tokens are required to be signed by the algorithm specified in the message. Tokens that are signed with any other signature algorithm cannot be validated. |
Action | Obtain a new token that is signed using the required algorithm specified in the message, or update your JWT configuration to allow tokens that are signed using the other signature algorithm. |
Explanation | If using the HS256 signature algorithm, a shared key might not be specified in your JWT consumer configuration, or an empty value is specified. If using the RS256 signature algorithm, the key store service might not be available, or a key cannot be found within the truststore that matches the trusted alias specified by the JWT consumer configuration. |
Action | Check the server logs for any additional error messages that explain why a key cannot be found. If using the HS256 signature algorithm, ensure that a shared key is specified in your JWT consumer configuration. If using the RS256 signature algorithm, ensure that the truststore and trust alias in your consumer configuration are configured correctly. |
Explanation | A JWT consumer configuration with the specified identifier cannot be found in the server configuration. |
Action | Make sure that there is a jwtConsumer element configured with the specified ID in the server configuration. |