PH62934: OIDC: INCREASE NONCE CHARACTERS TO 22 OR MORE

APAR status

• Closed as program error.

Error description

• The OIDC TAI emits a nonce value that is less than 22
  characters.  Although the OIDC specification does not provide
  a minimum number of characters for the nonce value, the US
  login.gov requirements for OIDC,
  https://developers.login.gov/oidc/authorization/ , specifies
  that a minimum of 22 characters is required for the nonce
  length.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  IBM WebSphere Application Server users of   *
  *                  OIDC                                        *
  ****************************************************************
  * PROBLEM DESCRIPTION: The OIDC TAI emits a nonce value that   *
  *                      is                                      *
  *                      less than 22 characters.                *
  ****************************************************************
  * RECOMMENDATION:  Install a fix pack or interim fix that      *
  *                  contains this APAR.                         *
  ****************************************************************
  The OIDC TAI emits a nonce value that is less than 22
  characters.
  Some OpenID Connect providers might reject a request that has a
  nonce value that is less than 22 characters.
  

Problem conclusion

• The OIDC TAI is updated to emit a nonce value that is 22
  characters or more.
  
  The fix for this APAR is targeted for inclusion in fix pack
  8.5.5.27 and 9.0.5.22. For more information, see 'Recommended
  Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBSPHERE APP S

• Fixed component ID

  5724J0800

Applicable component levels