PH47482: OIDC: ADD WAS_DEFAULT TO USEREALM PROPERTY TO MEAN THE DEFAULT REALM NAME INSTEAD OF REQUIRING A FIXED VALUE

APAR status

• Closed as program error.

Error description

• Many administrators do not want to rely on external realm
  names for security when using the OpenID Connect (OIDC) Trust
  Association Interceptor (TAI). For this reason, they prefer to
  have OIDC logins be done using the current WebSphere realm
  rather than the realm from the OP, or a custom realm.  This is
  done by setting the provider_(id).useRealm OIDC TAI property to
  the same String value as the current WebSphere realm name.
  
  Setting this property requires that the administrator locate
  their default realm name so that it can be set it on the
  provider_(id).useRealm property.  There should be a way to tell
  the OIDC TAI to pick up the default realm name
  programmatically.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server                                      *
  *                  and the OIDC TAI                            *
  ****************************************************************
  * PROBLEM DESCRIPTION: There is no way to tell the OIDC TAI to *
  *                      default the realm name to the current   *
  *                      WebSphere realm name.                   *
  ****************************************************************
  * RECOMMENDATION:  Install a fix pack or interim fix that      *
  *                  contains this APAR                          *
  ****************************************************************
  There is no way to configure the OIDC TAI to default the realm
  name to the current WebSphere realm name.
  

Problem conclusion

• The OIDC TAI is updated so that you can configure the TAI to use
  the current WebSphere realm name when creating the Subject for
  requests.  This applies to both the OIDC Relying Party (RP) and
  JWT Authentication.
  
  When the provider_(id).useRealm OIDC custom property is set to
  the value WAS_DFAULT, the current WebSphere realm is used when
  the Subject is created for the inbound request.
  
  The fix for this APAR is targeted for inclusion in fix pack
  8.5.5.23 and 9.0.5.13. For more information, see 'Recommended
  Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels