IBM Support

PI30212: CWWSS8031E ERROR WHEN A REQUEST MATCHES THE ACSURL AND FILTER DEFINITIONS FOR THE SAML WEB SSO ACSTRUSTASSOCIATIONINTERCEPTOR

Subscribe

You can track all active APARs for this component.

APAR status

  • Closed as program error.

Error description

  • When a given request matches both the acsUrl URL string and a
    filter criteria defined the SAML Web SSO TAI configuration,
    the following error is emitted and the request receives a 401
    response:
    
    CWWSS8031E: This TAI could not uniquely identify one
    Single-Sign-On partner for this request
    

Local fix

  • Modify filter criteria so that they don't match the acsUrl
    

Problem summary

  • ****************************************************************
    * USERS AFFECTED:  IBM WebSphere Application Server users of   *
    *                  SAML web single sign-on                     *
    ****************************************************************
    * PROBLEM DESCRIPTION: A 401 response is sent from SAML Web    *
    *                      SSO TAI if a request matches both the   *
    *                      acsUrl and configured filters.          *
    ****************************************************************
    * RECOMMENDATION:  Install a fix pack that contains this       *
    *                  APAR.                                       *
    ****************************************************************
    When SAML web single sign-on (SAML Web SSO) request is
    received by the SAML trust association interceptor (TAI)
    matches both the acsUrl and one or more configured filters for
    the same service provider (SP) configuration, an error will
    occur.  A 401 response will be returned and the following
    error is emitted:
    CWWSS8031E: This TAI could not uniquely identify one
    Single-Sign-On partner for this request
    

Problem conclusion

  • The SAML Web SSO TAI is updated so an error will not occur if
    a request is received that matches an acsUrl and one or more
    filters for the service provider.
    
    The fix for this APAR is currently targeted for inclusion in
    fix packs 7.0.0.39, 8.0.0.11 and 8.5.5.6.  Please refer to the
    Recommended Updates page for delivery information:
    http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
    
    Keywords: IBMWL3WSS, SAMLWSSO
    

Temporary fix

Comments

APAR Information

  • APAR number

    PI30212

  • Reported component name

    WEBS APP SERV N

  • Reported component ID

    5724H8800

  • Reported release

    850

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2014-11-21

  • Closed date

    2015-02-11

  • Last modified date

    2015-09-09

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    WEBS APP SERV N

  • Fixed component ID

    5724H8800

Applicable component levels

  • R700 PSY

       UP

  • R800 PSY

       UP

  • R850 PSY

       UP



Document information

More support for: WebSphere Application Server
General

Software version: 850

Reference #: PI30212

Modified date: 09 September 2015