PH68876: CREDENTIALEXCEPTION: THE CLIENT ID OR THE REALM NAME IS NOT SET OR IS NOT A MATCH FOR THE INCOMING REQUEST.

APAR status

• Closed as program error.

Error description

• Liberty on z/OS running with openidConnectClient
  
  javax.security.auth.login.CredentialException:
  
  The client ID or the realm name is not set or is not a match
  for the incoming request.
  
  Please check your Openid Connect Client configuration
  com.ibm.ws.security.credentials.saf.mapIdentity.MapIdentityToRe
  gistryUserServiceImpl.checkMapIdentityToRegistryUser
  com.ibm.ws.security.credentials.saf.internal.SAFCredentialsServ
  iceImpl.setCredential
  com.ibm.ws.security.credentials.internal.CredentialsServiceImpl
  .setCredentials
  com.ibm.ws.security.authentication.internal.jaas.modules.Server
  CommonLoginModule.setCredentials
  com.ibm.ws.security.authentication.jaas.modules.HashtableLoginM
  odule.setUpTemporarySubject
  com.ibm.ws.security.authentication.jaas.modules.HashtableLoginM
  odule.handleUserId
  com.ibm.ws.security.authentication.jaas.modules.HashtableLoginM
  odule.login
  com.ibm.ws.kernel.boot.security.LoginModuleProxy.login
  java.base/javax.security.auth.login.LoginContext.invoke
  java.base/javax.security.auth.login.LoginContext$4.run
  java.base/javax.security.auth.login.LoginContext$4.run
  java.base/java.security.AccessController.doPrivileged
  java.base/javax.security.auth.login.LoginContext.invokePriv
  java.base/javax.security.auth.login.LoginContext.login
  com.ibm.ws.security.authentication.internal.jaas.JAASServiceImp
  l.doLoginContext
  com.ibm.ws.security.authentication.internal.jaas.JAASServiceImp
  l.performLogin
  com.ibm.ws.security.authentication.internal.jaas.JAASServiceImp
  l.performLogin
  com.ibm.ws.security.authentication.internal.AuthenticationServi
  ceImpl.performJAASLogin
  com.ibm.ws.security.authentication.internal.AuthenticationServi
  ceImpl.authenticate
  com.ibm.ws.webcontainer.security.WebProviderAuthenticatorHelper
  .authenticateWithSubject
  com.ibm.ws.webcontainer.security.WebProviderAuthenticatorHelper
  .loginWithUserName
  

Local fix

• Set realmName on openidConnectClient
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of WebSphere Liberty on z/OS      *
  ****************************************************************
  * PROBLEM DESCRIPTION: After upgrading to 25.0.0.9 and using   *
  *                      OpenIdConnect, the following            *
  *                      exception is seen:                      *
  *                      com.ibm.ws.logging.internal.impl.Incide *
  *                      ntImpl                I FFDC1015I: An   *
  *                      FFDC Incident has been created:         *
  *                      "javax.security.auth.login.CredentialEx *
  *                      ception: The client ID or the realm     *
  *                      name is not set or is not a match for   *
  *                      the incoming request. Please check      *
  *                      your Openid Connect Client              *
  *                      configuration                           *
  *                      com.ibm.ws.security.authentication.jaas *
  *                      .modules.HashtableLoginModule 232" at   *
  *                      ffdc_25.10.27_16.22.20.0.log            *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  After upgrading to 25.0.0.9 and using
  OpenIdConnect, the following
  exception is seen:
  com.ibm.ws.logging.internal.impl.Incide
  ntImpl                I FFDC1015I: An
  FFDC Incident has been created:
  "javax.security.auth.login.CredentialEx
  ception: The client ID or the realm
  name is not set or is not a match for
  the incoming request. Please check
  your Openid Connect Client
  configuration
  com.ibm.ws.security.authentication.jaas
  .modules.HashtableLoginModule 232" at
  ffdc_25.10.27_16.22.20.0.log
  

Problem conclusion

• The code has been revised an updated so that an FFDC is not
  thrown when the realmName is not included in the
  openidConnectClient
  
  The fix for this APAR is targeted for inclusion in fix pack
  26.0.0.1. For more information, see 'Recommended Updates for
  WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

• Adding the realm in the openidConnectClient should solve the
  problem:
  
  	<openidConnectClient
  		id="client01"
  ...
          realmName="client01"
  ...
  	>
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  LIBERTY PROF -

• Fixed component ID

  5655W6514

Applicable component levels