PH62980: OIDC TAI CANNOT MODIFY AUTHORIZE ENDPOINT WHEN USING DISCOVERY

APAR status

• Closed as program error.

Error description

• The preferred method for configuring endpoints for the OIDC TAI
  is to use discovery.  When you use discovery, you cannot
  override any value that is obtained from the OP's discovery
  endpoint.  There are use cases where you might want to add
  parameters to the authorization endpoint to comply with
  requirements of an OP.  With the present scheme, if you must
  hardcode the authorization endpoint, you must hardcode all of
  the endpoints; you cannot use discovery.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  IBM WebSphere Application Server of OIDC    *
  ****************************************************************
  * PROBLEM DESCRIPTION: The OIDC TAI cannot override the        *
  *                      authorization endpoint URL that is      *
  *                      obtained from discovery.                *
  ****************************************************************
  * RECOMMENDATION:  Install a fix pack or interim fix that      *
  *                  contains this APAR.                         *
  ****************************************************************
  The OIDC TAI cannot override the authorization endpoint URL that
  is obtained from discovery.  If you require an authorization
  endpoint URL that is different from one that is in the discovery
  output, you must hardcode all the OP data with OIDC custom
  properties.  This can be an error-prone task for a customer.
  

Problem conclusion

• The following OIDC TAI custom property is added:
  
  authzParameters
  
  Values:
  There is no default value for this property.
  
  Description:
  Set the value for this property to the parameters to add to the
  authorization request to the OP. This property applies to an
  authorization endpoint URL that is obtained by custom property
  or discovery. For example, when the authorization endpoint URL
  is set to https://company.co/auth and authzParameters is set to
  abc=a&cde=c, the authorization request that is sent to the
  server is https://company.com/auth?abc=a&cde=c.
  
  The fix for this APAR is targeted for inclusion in fix packs
  8.5.5.27 and 9.0.5.22. For more information, see 'Recommended
  Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBSPHERE APP S

• Fixed component ID

  5724J0800

Applicable component levels