PH27213: OIDC TAI: GIVE OPTION TO NOT WRITE LTPA COOKIE IN RP PATH

PH29099: OIDC v1.3.1; OIDC RP: ClassNotFoundException for JsonUtil$DupeKeyDisallowingLinkedHashMap
PH39666: OIDC v1.3.2; OIDC RP: Initial login might fail when the OIDC stateId contains special characters
PH49566: OIDC v1.4.0; OIDC: CWTAI2047E when more than one key without alg claim in JWK

APAR status

• Closed as new function.

Error description

• When using the OpenID Connect (OIDC) relying party, after
  successful login completion, an administrator might not want an
  LTPA cookie written to the browser.
  
  You can control this behavior when performing JWT
  Authentication, but you cannot when the OIDC trust association
  interceptor (TAI) is acting as a traditional OpenID Connect
  relying party.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server and OpenID Connect                   *
  ****************************************************************
  * PROBLEM DESCRIPTION: Give option to not write an LTPA        *
  *                      cookie                                  *
  *                      in the OIDC RP.                         *
  ****************************************************************
  * RECOMMENDATION:  Install a fix pack or interim fix that      *
  *                  contains this APAR.                         *
  ****************************************************************
  When using the OIDC TAI, an administrator has the option to not
  write an LTPA cookie if they are performing JWT authentication.
  If they are using the OIDC relying party (RP) function of the
  OIDC TAI, there is no option to not write an LTPA cookie.
  

Problem conclusion

• The OIDC TAI property provider_(id).setLtpaCookie is updated so
  that it applies to both the OIDC relying party and JWT
  authentication:
  
  provider_<id>.setLtpaCookie
  
  Defaults:
  When when useJwtFromRequest is set to required, the default is
  true. Otherwise, the default is false.
  
  Description:
  When this property is set to true, the runtime will set an LTPA
  Cookie on the response after successful authentication with the
  inbound JWT is complete.
  
  The fix for this APAR is targeted for inclusion in fix packs
  8.5.5.18 and 9.0.5.5. For more information, see 'Recommended
  Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels