PI59831: SUPPORT FOR USING LOCAL X509 PUBLIC CERTIFICATE FOR SIGNATURE VERIFICATION IN OIDC.

PI55697: OpenID Connect Relying Party : No entry in cache for stateid
8.5.5.10: WebSphere Application Server V8.5.5 Fix Pack 10
8.5.5.11: WebSphere Application Server V8.5.5 Fix Pack 11
8.0.0.13: WebSphere Application Server V8.0 Fix Pack 13
8.5.5.12: WebSphere Application Server V8.5.5 Fix Pack 12
8.0.0.14: WebSphere Application Server V8.0 Fix Pack 14
8.5.5.13: WebSphere Application Server V8.5.5 Fix Pack 13
8.0.0.15: WebSphere Application Server V8.0 Fix Pack 15
PI96508: OIDC v1.05; OIDC RP may not connect to token endpoint due to SSL handshake failure
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14
8.5.5.15: WebSphere Application Server V8.5.5 Fix Pack 15
PH08804: OIDC v1.1.0; OIDC RP default identifiers are not available when customs are configured
PH13175: OIDC v1.2.0; OIDC RP tokens are not revoked when sessions are evicted from the cache
8.5.5.17: WebSphere Application Server V8.5.5 Fix Pack 17
PH29099: OIDC v1.3.1; OIDC RP: ClassNotFoundException for JsonUtil$DupeKeyDisallowingLinkedHashMap
8.5.5.20: WebSphere Application Server V8.5.5.20
8.5.5.18: WebSphere Application Server V8.5.5 Fix Pack 18
8.5.5.19: WebSphere Application Server V8.5.5 Fix Pack 19
PH39666: OIDC v1.3.2; OIDC RP: Initial login might fail when the OIDC stateId contains special characters
8.5.5.16: WebSphere Application Server V8.5.5 Fix Pack 16
8.5.5.21: WebSphere Application Server V8.5.5.21

APAR status

• Closed as program error.

Error description

• The OpenID Connect Relying Party TAI should support X.509
  asymmetric signature with something other than a JSON Web Key.
  There should be some way to use an X.509 public certificate
  available on the local system.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server                                      *
  ****************************************************************
  * PROBLEM DESCRIPTION: Add support for local X.509 public      *
  *                      certificate for signature validation    *
  *                      in OpenID Connect Relying Party TAI     *
  ****************************************************************
  * RECOMMENDATION:  Install a fix pack that contains this       *
  *                  APAR.                                       *
  ****************************************************************
  With the OpenID Connect (OIDC) Relying Party, you have no
  option to use X.509 asymmetric signature if you do not have a
  JSON Web Key (JWK).
  

Problem conclusion

• An option to use a local public certificate for signature
  validation is added to the OIDC Relying Party TAI.
  
  The following OIDC TAI custom property is added:
  
  provider_<id>.signVerifyAlias
  
  This property specifies the alias of the certificate in the
  centralized trust store that will be used to verify the
  signature from the OP.  On a single server, the trust
  store is the NodeDefaultTrustStore, otherwise, it is the
  CellDefaultTrustStore.
  
  This property must be set if the signatureAlgorithm custom
  property is set to RS256 and you do not set the
  provider_<id>.jwkEndpointUrl custom property to obtain the
  OP's JSON Web Key (JWK).
  
  The fix for this APAR is currently targeted for inclusion in
  fix packs 8.0.0.12 and 8.5.5.10.  Please refer to the
  Recommended Updates page for delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  
  Keywords: IBMWL3WSS, OIDC
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBSPHERE APP S

• Fixed component ID

  5724J0800

Applicable component levels

• R800 PSY

     UP

• R850 PSY

     UP