PH39666: OIDC RP: Initial login might fail when the OIDC stateId contains special characters

OIDC RP initial login might fail when OIDCSTATE name contains a reserved token.

• CWTAI2007E: The OpenID Connect relying party (RP) encountered a failure during the login. The exception is [Cookie name "OIDCSTATE_BxEIAQzE+axNDRKbJvxvBGIcN8YrylsxeE4bFpeAfeA=_16272857 85897" is a reserved token].

  • This error occurs at the time the cookie is written.
  • This error occurs only when not using JavaScript and might be fixed by setting provider_(id).useJavaScript=true (the default).

• CWTAI2019E: The state id [sS2cjek8eI1Ep9H+ua//a94hDmG1/SeXxL8SDtym2VQ=_1633426286881] in the OpenID Connect relying party (RP) state cookie [OIDCSTATE_rp1] does not match the state id [sS2cjek8eI1Ep9H ua//a94hDmG1/SeXxL8SDtym2VQ=_1633426286881] received from the OpenID Connect provider.

  • This error occurs when processing a login response from the OP. 
  • The original outbound stateId includes a plus sign, but the plus sign is missing from the stateId in the inbound response. 
  • The plus sign disappears because it has special meaning in a URL query string.  If a plus sign appears in a stateId, this error always occurs.

• CWTAI2030I: The OpenID Connect TAI was unable to retrieve the request data with stateId [ThgkXKF1H4QGyBuHYGyn65ffJCoZUnawsBRTR861RsU%3D_1636053405653] from the state map. It may have expired.

  • This error occurs when processing a login response from the OP. 
  • The original outbound stateId includes an equal sign, but the RP retrieves a stateId from the response that has the equal sign encoded as a %3D.
  • It is normal for an OP to encode special characters on its outbound responses. However, it is not normal for the RP runtime to retrieve parameters that are still encoded.  When an equal sign is in the stateId, this error does not always occur.  You can see in the previous error that the equal sign is not encoded.