PI52604: OPENID CONNECT SSO WITH ACTIVE DIRECTORY FAILS WITH 403 FORBIDDEN

PI55697: OpenID Connect Relying Party : No entry in cache for stateid
8.5.5.10: WebSphere Application Server V8.5.5 Fix Pack 10
8.5.5.11: WebSphere Application Server V8.5.5 Fix Pack 11
8.0.0.13: WebSphere Application Server V8.0 Fix Pack 13
8.5.5.12: WebSphere Application Server V8.5.5 Fix Pack 12
8.0.0.14: WebSphere Application Server V8.0 Fix Pack 14
8.5.5.13: WebSphere Application Server V8.5.5 Fix Pack 13
8.0.0.15: WebSphere Application Server V8.0 Fix Pack 15
PI96508: OIDC v1.05; OIDC RP may not connect to token endpoint due to SSL handshake failure
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14
8.5.5.15: WebSphere Application Server V8.5.5 Fix Pack 15
PH08804: OIDC v1.1.0; OIDC RP default identifiers are not available when customs are configured
PH13175: OIDC v1.2.0; OIDC RP tokens are not revoked when sessions are evicted from the cache
8.5.5.17: WebSphere Application Server V8.5.5 Fix Pack 17
PH29099: OIDC v1.3.1; OIDC RP: ClassNotFoundException for JsonUtil$DupeKeyDisallowingLinkedHashMap
8.5.5.20: WebSphere Application Server V8.5.5.20
8.5.5.18: WebSphere Application Server V8.5.5 Fix Pack 18
8.5.5.19: WebSphere Application Server V8.5.5 Fix Pack 19
PH39666: OIDC v1.3.2; OIDC RP: Initial login might fail when the OIDC stateId contains special characters
8.5.5.16: WebSphere Application Server V8.5.5 Fix Pack 16
8.5.5.21: WebSphere Application Server V8.5.5.21

APAR status

• Closed as program error.

Error description

• We are using the WebSphere Application Server SSO solution with
  the OpenID connect protocol with Azure active directory
  
  We see an HTTP 403 Forbidden error
  
  From WebSphere Application Server trace, it shows AD is
  complaining about WebSphere Application Server sending
  an invalid request to AD because of missing the client_id
  attribute.
  
  The error is a 400 reply from AD:
  [{"error":"invalid_request","error_description":"AADSTS90014:
  The request body must contain the following parameter:
  'client_id'.\r\nTrace ID:
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  IBM WebSphere Application Server            *
  *                  administrators of OpenID Connect            *
  ****************************************************************
  * PROBLEM DESCRIPTION: The OpenID Connect relying party may    *
  *                      not interact properly with an Azure     *
  *                      active directory IdP.                   *
  ****************************************************************
  * RECOMMENDATION:  Install a fix pack that includes this       *
  *                  APAR.                                       *
  ****************************************************************
  When the WebSphere OpenID Connect (OIDC) relying party (RP)
  Trust Association Interceptor (TAI) is used with Azure active
  directory as the identity provider (IdP), an HTTP 403
  Forbidden error may be returned from the TAI.
  An HTTP 400 error similar to the following is returned from the
  IdP when the initial login is attempted:
  [{"error":"invalid_request","error_description":"AADSTS90014:
  The request body must contain the following parameter:
  'client_id'.
  

Problem conclusion

• Some identity providers (IdPs) require that the client_id and
  client_secret parameters be URL encoded.  The OpenID Connect
  (OIDC) relying party (RP) does not URL encode these parameters.
  
  The OIDC RP is updated to optionally URL encode the client_id
  and client_secret parameters.  To do this, add the following
  OIDC RP TAI custom property:
  
  encodeParameters=true
  
  Valid values for this custom property are true and false.  The
  default value is false.
  
  The fix for this APAR is currently targeted for inclusion in
  fix packs 8.0.0.13 and 8.5.5.10.  Please refer to the
  Recommended Updates page for delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  
  Keywords: IBMWL3WSS OIDC
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels

• R800 PSY

     UP

• R850 PSY

     UP