IV31641: FIX FOR IZ85970 DOESN'T ALWAYS WORK

Tivoli Federated Identity Manager 6.2.2 Fixpack 4 (6.2.2-TIV-TFIM-FP0004)
Tivoli Federated Identity Manager 6.2.2 Fixpack 6 (6.2.2-TIV-TFIM-FP0006)

APAR status

• Closed as program error.

Error description

• Using an extened use case of IZ85970
  
  The notes for the fix state that the Recipient can be
  overwritten with the ContextAttributes attribute Recipient.
  Given the following use case, I would expect the Recipient to
  pulled from the STSUUSER, but it is not used.
  
  User sends a WST RST message with a STSUUSER in the
  wst:ValidateTarget.
  
  This STSUUSER has the Recipient context attribute set, which
  propagates to the outer shell STSUUSER later in TFIM processing.
  The WST does not have a claims element.
  
  So the parameter override is there, but because the STSUUSER
  that gets passed to the SAML module in this case doesn't have a
  claims element the override is ignored.
  

Local fix

• none working at this time.
  

Problem summary

• SubjectConfirmationData is missing when generating a
  SAML 2.0 assertion with Bearer subject confirmation method
  and no claims is supplied in the RST.
  

Problem conclusion

• The fix for this APAR is contained in the following maintenance
  packages:
  | fix pack | 6.2.2-TIV-TFIM-FP0004
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

  IV29471

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  TIV FED ID MGR

• Fixed component ID

  5724L7300

Applicable component levels

• R622 PSY

     UP