PH51712: ADMINTASK.DELETESAMLTAISSO DOES NOT DELETE THE SIGNING CERTIFICATE

APAR status

• Closed as program error.

Error description

• The AdminTask.deleteSAMLTAISSO command does not delete the
  signing certificate from the truststore when
  -deleteSigningCert=true.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server                                      *
  ****************************************************************
  * PROBLEM DESCRIPTION: The AdminTask.deleteSAMLTAISSO command  *
  *                      does not delete the signing             *
  *                      certificate from the truststore.        *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  The AdminTask.deleteSAMLTAISSO command does not delete the
  signing
  certificate from the truststore when -deleteSigningCert=true.
  When the following command is issued, the truststore is not
  updated:
  AdminTask.deleteSAMLTAISSO('-ssoId 1 -deleteSigningCert true')
  

Problem conclusion

• The AdminTask.deleteSAMLTAISSO command is updated to delete the
  signing certificate that is configured on the
  sso_(id).sp.trustedAlias property from the truststore that is
  configured on the sso_(id).sp.trustStore property unless the
  alias is in use by another SP.
  
  When the following command is issued, the command deletes the
  signing certificate associated with the sso_1.sp.trustedAlias
  from the sso_1.sp.trustStore if the alias is not in use by
  another SP.
  
  AdminTask.deleteSAMLTAISSO('-ssoId 1 -deleteSigningCert true')
  
  The fix for this APAR is targeted for inclusion in fix pack
  8.5.5.24 and 9.0.5.16. For more information, see 'Recommended
  Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels