PH47461: SAML: ADD WAS_DEFAULT TO USEREALM PROPERTY TO MEAN THE DEFAULT REALM NAME INSTEAD OF REQUIRING A FIXED VALUE

APAR status

• Closed as program error.

Error description

• Many administrators do not want to rely on external realm
  names for security when using SAML Web SSO. For this reason,
  they prefer to have SAML logins be done using the current
  WebSphere realm rather than the realm (Issuer) from the IdP, or
  a custom realm.  This is done by setting the
  sso_<id>.sp.useRealm SAML TAI to the same String value as the
  current WebSphere realm name.
  
  Setting this property requires that the administrator locate
  their default realm name so that it can be set it on the
  sso_(id).sp.useRealm property.  There should be a way to tell
  the SAML TAI to pick up the default realm name
  programmatically.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server                                      *
  *                  and SAML Web SSO                            *
  ****************************************************************
  * PROBLEM DESCRIPTION: There is no way to tell the SAML Web    *
  *                      SSO                                     *
  *                      TAI to default the realm name to the    *
  *                      current WebSphere realm name.           *
  ****************************************************************
  * RECOMMENDATION:  Install a fix pack or interim fix that      *
  *                  contains this APAR                          *
  ****************************************************************
  There is no way to configure the SAML Web SSO TAI to default the
  realm name to the current WebSphere realm name.
  

Problem conclusion

• The SAML Web SSO TAI is updated so that you can configure the
  TAI to use the current WebSphere realm name when creating the
  Subject for requests.
  
  When the sso_(id).sp.useRealm SAML Web SSO TAI custom property
  is set to the value WAS_DFAULT, the current WebSphere realm is
  used when the Subject is created for the inbound request.
  
  The fix for this APAR is targeted for inclusion in fix pack
  8.5.5.23 and 9.0.5.13. For more information, see 'Recommended
  Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels