PI96508: OIDC RP may not connect to token endpoint due to SSL handshake failure

Download Description

THIS FIX HAS BEEN SUPERSEDED BY THE A LATER IFIX
This fix has been superseded by a fix for another APAR. For information on how to obtain the latest OpenID Connect runtime that includes this APAR, see the technote Obtaining WebSphere OpenID Connect (OIDC) latest version.


PI96508 resolves the following problem:

ERROR DESCRIPTION:
The OpenID Connect (OIDC) Relying Party (RP) Trust Association Interceptor (TAI) improperly obtains the default SSL socket factory, which can cause an SSL handshake failure when attempting to connect to the token endpoint:

[3/23/18 1:30:57:659 CDT] 000000dd WebAuthentica E SECJ0126E: Trust Association failed during validation. The exception is
com.ibm.websphere.security.WebTrustAssociationFailedException:
CWTAI2007E: The OpenID Connect relying party (RP) encountered a failure during the login. The exception is [Failed to make a request to OP server]. Check the logs for details that lead to this exception.
at com.ibm.ws.security.oidc.client.RelyingParty.handleSigninCallback(RelyingParty.java:468)
at com.ibm.ws.security.oidc.client.RelyingParty.negotiateValidateandEstablishTrust(RelyingParty.java:249)
at com.ibm.ws.security.web.TAIWrapper.negotiateAndValidateEstablishedTrust(TAIWrapper.java:103)
at (snip ...)
... 28 more
Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert:
handshake_failure
at com.ibm.jsse2.p.a(p.java:1)
at com.ibm.jsse2.p.a(p.java:13)

This issue may manifest itself in ways other than an SSL Handshake failure.

PROBLEM CONCLUSION:
The OIDC TAI is updated to obtain the default SSL socket factory in the manner that is required by WebSphere Application Server core security.

The fix for this APAR is currently targeted for inclusion in fix packs 8.5.5.14 and 9.0.0.9. Please refer to the Recommended Updates page for delivery information:
http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980

Keywords: IBMWL3WSS, OIDC

THIS FIX HAS BEEN SUPERSEDED BY THE A LATER IFIX
This fix has been superseded by a fix for another APAR. For information on how to obtain the latest OpenID Connect runtime that includes this APAR, see the technote Obtaining WebSphere OpenID Connect (OIDC) latest version.