PH69515: OIDC MIGHT GET A STATE COOKIE ERROR WHEN THE CLIENTSECRET PARAMETER IS NOT SET

APAR status

• Closed as program error.

Error description

• When the clientSecret is not provided in the OIDC config, if the
  state data must be read from the State cookie value, an error
  like the following might be emitted:
  
  - The OIDC state cookie [OIDCSTATE_rp1] is not in the correct
  format.
  

Local fix

• Reconfigure the OIDC TAI with a clientSecret property.  This
  might require a change in the OP's configuration.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server and OIDC                             *
  ****************************************************************
  * PROBLEM DESCRIPTION: OIDC authentication might fail if the   *
  *                      clientSecret parameter is not set to    *
  *                      a value.                                *
  ****************************************************************
  When the clientSecret is not provided in the OIDC config, if the
  state data must be read from the State cookie value, an error
  like the following might be emitted: - The OIDC state cookie
  [OIDCSTATE_rp1] is not in the correct format. The following
  entry appears in an OIDC trace: [12/16/25 16:09:35:474 EET]
  000001c9 StateData 3 The cookie may have been tampered with.
  [12/16/25 16:09:35:474 EET] 000001c9 StateData 3 The cookie does
  not contain an underscore.
  

Problem conclusion

• The fix for this APAR is targeted for inclusion in fix packs
  9.0.5.28 and 8.5.5.30. For more information, see 'Recommended
  Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBSPHERE APP S

• Fixed component ID

  5724J0800

Applicable component levels