PH46324: OIDC: CWTAI2047E ERROR OCCURS WHEN NO KID CLAIM IN THE JWT HEADER

APAR status

• Closed as program error.

Error description

• When the OpenID Connect (OIDC) Trust Association Interceptor
  (TAI) processes a request with JWT that has a signature header
  that does not contain a 'kid' claim, the request fails.  The
  'kid' claim is not required in the signature header.
  
  An error like the following is found in the logs:
  CWTAI2047E: A signing key required by the RS512 signature
  algorithm was not available. Signing key is not valid
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server                                      *
  *                  and the OIDC TAI                            *
  ****************************************************************
  * PROBLEM DESCRIPTION: A CWTAI2047E might occur when the OIDC  *
  *                      TAI processes a request with no 'kid'   *
  *                      claim in the JWT header.                *
  ****************************************************************
  * RECOMMENDATION:  Install a fix pack or interim fix that      *
  *                  contains this APAR.                         *
  ****************************************************************
  The OIDC TAI might emit a CWTAI2047E error when there is no
  'kid'
  claim in a JWT.
  

Problem conclusion

• The OIDC TAI is updated so that it can handle a JWT that has no
  'kid' claim.  When there is no 'kid' claim in the JWT header,
  there must be only one key in the associated JWK, otherwise the
  request is rejected.
  
  The fix for this APAR is targeted for inclusion in fix pack
  8.5.5.23 and 9.0.5.13. For more information, see 'Recommended
  updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels