PH55077: OIDC ENABLE INTROSPECTION TO USE USERINFO ENDPOINT

APAR status

• Closed as program error.

Error description

• Allow introspection to use the OpenID provider's UserInfo
  endpoint instead of its introspection endpoint.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  IBM WebSphere Application Server and OIDC   *
  *                                                              *
  ****************************************************************
  * PROBLEM DESCRIPTION: The OIDC TAI can only introspect tokens *
  *                      by using the OP's introspect endpoint.  *
  ****************************************************************
  * RECOMMENDATION:  Install a fix pack or interim fix that      *
  *                  contains this APAR.                         *
  ****************************************************************
  The OIDC TAI can only introspect tokens by using the OpenID
  Connect provider's introspect endpoint.  Users might want to use
  the UserInfo endpoint for introspection instead.
  

Problem conclusion

• The OIDC TAI is updated so that it can introspect by using the
  OP's UserInfo endpoint.
  
  The following OIDC custom property is added:
  
  provider_(id).introspectMethod
  values: introspect , userinfo
  default: introspect
  
  If the provider_(id).introspectMethod property is set to
  introspect, the introspect_endpoint is used for introspection.
  
  If the provider_(id).introspectMethod property is set to
  userinfo, the userinfo_endpoint is used for introspection.
  
  The fix for this APAR is targeted for inclusion in fix packs
  8.5.5.25 and 9.0.5.19. For more information, see 'Recommended
  Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels