PI88896: OIDC RP REFRESHED ACCESS_TOKEN IS NOT PUT INTO SUBJECT

8.0.0.15: WebSphere Application Server V8.0 Fix Pack 15
PI96508: OIDC v1.05; OIDC RP may not connect to token endpoint due to SSL handshake failure
9.0.0.8: WebSphere Application Server traditional V9.0 Fix Pack 8
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14
9.0.0.9: WebSphere Application Server traditional V9.0 Fix Pack 9
9.0.0.10: WebSphere Application Server traditional V9.0 Fix Pack 10
8.5.5.15: WebSphere Application Server V8.5.5 Fix Pack 15
PH08804: OIDC v1.1.0; OIDC RP default identifiers are not available when customs are configured
9.0.0.11: WebSphere Application Server traditional V9.0 Fix Pack 11
9.0.5.0: WebSphere Application Server traditional Version 9.0.5 Refresh Pack
PH13175: OIDC v1.2.0; OIDC RP tokens are not revoked when sessions are evicted from the cache
9.0.5.1: WebSphere Application Server traditional Version 9.0.5 Fix Pack 1
9.0.5.2: WebSphere Application Server traditional Version 9.0.5 Fix Pack 2
8.5.5.17: WebSphere Application Server V8.5.5 Fix Pack 17
9.0.5.3: WebSphere Application Server traditional Version 9.0.5 Fix Pack 3
9.0.5.4: WebSphere Application Server traditional Version 9.0.5 Fix Pack 4
9.0.5.5: WebSphere Application Server traditional Version 9.0.5 Fix Pack 5
PH29099: OIDC v1.3.1; OIDC RP: ClassNotFoundException for JsonUtil$DupeKeyDisallowingLinkedHashMap
WebSphere Application Server traditional 9.0.5.6
9.0.5.7: WebSphere Application Server traditional Version 9.0.5 Fix Pack 7
9.0.5.8: WebSphere Application Server traditional Version 9.0.5.8
8.5.5.20: WebSphere Application Server V8.5.5.20
8.5.5.18: WebSphere Application Server V8.5.5 Fix Pack 18
8.5.5.19: WebSphere Application Server V8.5.5 Fix Pack 19
9.0.5.9: WebSphere Application Server traditional Version 9.0.5.9
PH39666: OIDC v1.3.2; OIDC RP: Initial login might fail when the OIDC stateId contains special characters
9.0.5.10: WebSphere Application Server traditional Version 9.0.5.10
8.5.5.16: WebSphere Application Server V8.5.5 Fix Pack 16
8.5.5.21: WebSphere Application Server V8.5.5.21
9.0.5.11: WebSphere Application Server traditional Version 9.0.5.11

APAR status

• Closed as program error.

Error description

• If an OIDC access_token is refreshed by the WebSphere
  traditional OpenId Connect Relying Party (OIDC RP) TAI, the
  new access_token is not placed into the WebSphere Subject.
  

Local fix

• Disable the authentication cache
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  IBM WebSphere Application Server users of   *
  *                  OpenID Connect Relying Party                *
  ****************************************************************
  * PROBLEM DESCRIPTION: OIDC RP WebSphere Subject may not       *
  *                      contain current access_token            *
  ****************************************************************
  * RECOMMENDATION:  Install a fix pack or interim fix that      *
  *                  includes this APAR.                         *
  ****************************************************************
  In the authorization code flow, after the initial login, if
  the OpenID Connect Relying Party (RP) obtains a new access
  token (refresh) from the OpenID Provider (OP), the access token
  on the WebSphere Subject is not updated.
  The OIDC RP will need to refresh the access token if the
  access_token lifetime is shorter than that of the id_token.
  

Problem conclusion

• The OIDC RP is updated to ensure that the active access token
  is in the WebSphere Subject.
  
  Since this functionality relies on custom cache keys, the OIDC
  property includeCustomCacheKeyInSubject must be set to true
  (the default).
  
  The OIDC RP uses the access token stored in its private cache,
  not the one stored in the WebSphere Subject.  Because of this,
  this issue only affects applications that are attempting to
  retrieve the access token from the WebSphere Subject.
  
  The fix for this APAR is currently targeted for inclusion in
  fix pack 8.0.0.15, 8.5.5.14, and 9.0.0.8.  Please refer to the
  Recommended Updates page for delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels

• R800 PSY

     UP

• R850 PSY

     UP

• R900 PSY

     UP