PH28534: OIDC TAI: DO NOT LOAD CONFIG ENTRY IF NO FILTER DEFINED

PH29099: OIDC v1.3.1; OIDC RP: ClassNotFoundException for JsonUtil$DupeKeyDisallowingLinkedHashMap
PH39666: OIDC v1.3.2; OIDC RP: Initial login might fail when the OIDC stateId contains special characters

APAR status

• Closed as program error.

Error description

• With the OpenID Connect (OIDC) TAI, if there is no
  provider_(id).filter or provider_(id).interceptedPathFilter
  defined for a provider, its configuration loads, but it never
  intercepts requests.  No errors or warnings are emitted at the
  time the TAI configuration is loaded or when requests are
  processed.
  
  If there are no filters defined for a provider, an error should
  be emitted and its configuration should not load.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server and OpenID Connect                   *
  ****************************************************************
  * PROBLEM DESCRIPTION: The OIDC TAI allows a provider config   *
  *                      to                                      *
  *                      load if there are no filters defined.   *
  ****************************************************************
  * RECOMMENDATION:  Install a fix pack or interim fix that      *
  *                  contains this APAR.                         *
  ****************************************************************
  If the OIDC TAI configuration contains a provider config that
  has
  no filters (provider_(id).filter or
  provider_(id).interceptedPathFilter), the TAI will intercept no
  requests.  This presents problem determination issues.
  The TAI should emit an error and not load the provider config if
  there is not at least one filter present.
  

Problem conclusion

• If an OIDC TAI provider config does not contain either a
  provider_(id).filter or provider_(id).interceptedPathFilter
  property, the following will be emitted at the time the
  configuration loads and that provider config will not be active:
  
  CWTAI2022E: The OpenID Connect relying party (RP) TAI failed to
  initialized because it is configured with a combination of custo
  properties that will render the component inoperable: Neither th
  [filter], nor the [interceptedPathFilter] properties were
  provided.  At least one is required.
  
  This condition does not apply if the provider entry includes a
  provider_(id).grantType property.  A provider config that
  contains the grantType property is not intended to intercept
  requests, so no filter property is required.
  
  The fix for this APAR is targeted for inclusion in fix packs
  8.5.5.19 and 9.0.5.6. For more information, see 'Recommended
  Updates for WebSphere Application Server':
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels

• R850 PSY

     UP

• R900 PSY

     UP