IBM Support

PH08804: OIDC RP DEFAULT IDENTIFIERS ARE NOT AVAILABLE WHEN CUSTOMS ARE CONFIGURED

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

APAR status

  • Closed as new function.

Error description

  • OIDC: In the OpenID Connect (OIDC) Relying Party (RP) Trust
    Association Interceptor (TAI), the user name must exist in only
    one claim in every JWT. Either the default claim (sub) or an
    identifier for the custom claim must be configured.
    
    If most of the JWTs received by the RP contain the sub claim,
    but only a few don't, the OIDC RP will not operate properly. The
    administrator must make sure that all his OPs are standardized
    to meet the consistent claim requirement. This may not be
    possible for some administrators.
    

Local fix

  • N/A
    

Problem summary

  • ****************************************************************
    * USERS AFFECTED:  IBM WebSphere Application Server users of   *
    *                  OpenID Connect Relying Party                *
    ****************************************************************
    * PROBLEM DESCRIPTION: OIDC: Default identifiers are not       *
    *                      available when customs are configured.  *
    ****************************************************************
    * RECOMMENDATION:  Install a fix pack or interim fix that      *
    *                  contains this APAR.                         *
    ****************************************************************
    The OpenID Connect (OIDC) Relying Party (RP) Trust Association
    Interceptor (TAI) can only use the default or custom
    identifier to access the user name in the JWT received from
    the OpenID provider (OP).  There are use cases where an
    administrator may want to use a custom identifier only if the
    default identifier doesn't exist in the JWT.
    

Problem conclusion

  • The OIDC RP is updated to allow the TAI to use either the
    default or a custom identifier for user, unique user, group,
    or realm.
    
    The following property is added to the OIDC RP TAI custom
    properties:
    
    provider_<id>.useDefaultIdentifierFirst
    
    Values: true, false (default)
    
    Specifies that, if a custom identifier is specified for the
    user (userIdentifier), unique user (uniqueUserIdentifier),
    group (groupIdentifier), or realm (realmIdentifier), the
    custom value will only be used if the default value does not
    exist in the token.
    
    For example, if useDefaultIdentifierFirst=true and
    userIdentifier=username, for a JWT that contains sub=user1 and
    username=user2, the resolved user name would be user1.  If
    useDefaultIdentifierFirst=false, the resolved user name would
    be user2.
    
    The fix for this APAR is currently targeted for inclusion in
    fix pack 8.5.5.16 and 9.0.0.12.  Please refer to the
    Recommended Updates page for delivery information:
    http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
    

Temporary fix

Comments

APAR Information

  • APAR number

    PH08804

  • Reported component name

    WEBS APP SERV N

  • Reported component ID

    5724H8800

  • Reported release

    850

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2019-02-20

  • Closed date

    2019-03-11

  • Last modified date

    2019-03-11

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    WEBS APP SERV N

  • Fixed component ID

    5724H8800

Applicable component levels



Document information

More support for: WebSphere Application Server
General

Software version: 850

Reference #: PH08804

Modified date: 11 March 2019