PH45740: OIDC SETTING SIGNATUREALGORITHM TO NONE RESULTS IN ERROR

APAR status

• Closed as program error.

Error description

• In the OpenID Connect (OIDC) Trust Association Interceptor
  (TAI), when the provider_(id).signatureAlgorithm OIDC TAI
  property is set to the value 'none', one of the following errors
  might occur, depending on the WebSphere fixpack installed:
  
  CWTAI2047E: A signing key required by the <null> signature
  algorithm was not available. Signing key is not valid
  
  CWTAI2061E: The OpenID Connect relying party (RP) failed to
  initialize because the value of optional property
  [signatureAlgorithm] is set to [none], which is not one of the
  supported values [RS256, RS512, HS256].
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server                                      *
  *                  and the OIDC TAI                            *
  ****************************************************************
  * PROBLEM DESCRIPTION: Setting the OIDC TAI signatureAlgorithm *
  *                      property to none results in error       *
  *                      CWTAI2047E or CWTAI2061E.               *
  ****************************************************************
  * RECOMMENDATION:  Install a fix pack or interim fix that      *
  *                  contains this APAR.                         *
  ****************************************************************
  Setting the OIDC TAI signatureAlgorithm property to none results
  in error CWTAI2047E or CWTAI2061E.
  

Problem conclusion

• The OIDC TAI is updated so that the
  provider_(id).signatureAlgorithm property can be set to the valu
  'none' without error.
  
  The fix for this APAR is targeted for inclusion in fix pack
  8.5.5.23 and 9.0.5.13. For more information, see 'Recommended
  Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels