PH39847: OIDC RP: ENTRY IS NEVER REMOVED FROM CACHE WHEN INITIAL LOGIN IS VIA INTROSPECTION

PH39666: OIDC v1.3.2; OIDC RP: Initial login might fail when the OIDC stateId contains special characters

APAR status

• Closed as program error.

Error description

• The OIDC session cache timeout is not set properly when initial
  login is via introspection.  When OIDC initial login is via
  introspection, its session cache entry is never removed from
  the cache.
  
  The session cache timeout should the value for the
  provider_(id).sessionCacheTimeoutMinutes property, or the
  access token timeout if the
  provider_(id).sessionCacheTimeoutMinutes property is not
  specified.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  IBM WebSphere Application Server and the    *
  *                  OIDC                                        *
  *                  TAI                                         *
  ****************************************************************
  * PROBLEM DESCRIPTION: When OIDC RP initial login is via       *
  *                      introspection, its session cache entry  *
  *                      is                                      *
  *                      never removed from the cache            *
  ****************************************************************
  * RECOMMENDATION:  Install a fix pack or interim fix for this  *
  *                  APAR                                        *
  ****************************************************************
  The OIDC relying party (RP) session cache timeout is not set
  properly when initial login is via introspection.  When initial
  login is via introspection, its session cache entry is never
  removed from the cache.
  

Problem conclusion

• When the OIDC RP initial login is via introspection, the session
  cache timeout is always being set to zero and therefore the
  entry never expires and is never removed from the cache.
  
  The OIDC RP Trust Association Interceptor (TAI) is updated so
  that the session cache timeout is set properly when initial logi
  is via introspection.
  
  The fix for this APAR is targeted for inclusion in fix packs
  8.5.5.21 and 9.0.5.10.  For more information, see 'Recommended
  Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels

• R850 PSY

     UP

• R900 PSY

     UP