PH28386: OIDC RP: GIVE THE OPTION TO VALIDATE A JWT ACCESS TOKEN

PH29099: OIDC v1.3.1; OIDC RP: ClassNotFoundException for JsonUtil$DupeKeyDisallowingLinkedHashMap
PH39666: OIDC v1.3.2; OIDC RP: Initial login might fail when the OIDC stateId contains special characters

APAR status

• Closed as new function.

Error description

• Ordinarily, OpenID providers (OPs) return access tokens that
  are opaque and the Relying Party (RP) does nothing to verify
  them.  Some OPs can return access tokens that are JWTs.  If
  the access token returned by an OP is a JWT,
  the OpenID Connect (OIDC) RP Trust Association Interceptor
  (TAI) does not validate it.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server and OpenID Connect                   *
  ****************************************************************
  * PROBLEM DESCRIPTION: If the access token that is returned    *
  *                      from                                    *
  *                      the OP is a JWT, the OIDC TAI does not  *
  *                      validate it.                            *
  ****************************************************************
  * RECOMMENDATION:  Install a fix pack or interim fix that      *
  *                  contains this APAR.                         *
  ****************************************************************
  If an OP returns an access token that is a JWT, the OpenID
  Connect
  (OIDC) Trust Association Interceptor (TAI) does not validate it.
  An administrator may want to ensure that the JWT is valid.
  

Problem conclusion

• The following property is added to the OIDC TAI to allow the
  relying party to validate an access token that is a JWT:
  
  provider_(id).accessTokenIsJwt
  Values:
  true/false, default=false
  Description:
  Set this property to true if the access token that is returned
  from the OP is a JWT and you want the RP to validate the JWT.
  
  The fix for this APAR is targeted for inclusion in fix packs
  8.5.5.19 and 9.0.5.6. For more information, see 'Recommended
  Updates for WebSphere Application Server':
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBSPHERE APP S

• Fixed component ID

  5724J0800

Applicable component levels

• R850 PSY

     UP

• R900 PSY

     UP