PH27514: OIDC TAI ADD BASIC AUTH SUPPORT FOR THE JWK ENDPOINT

APAR status

• Closed as program error.

Error description

• The OpenID Connect (OIDC) TAI is unable obtain a JWK from the
  jwkEndpointUrl using basic authentication.
  

Local fix

• Download the JWKs to local and manually add it to the
  configuration
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server and OpenID Connect                   *
  ****************************************************************
  * PROBLEM DESCRIPTION: The OIDC TAI cannot send a basic        *
  *                      authentication header to the JWK        *
  *                      endpoint.                               *
  ****************************************************************
  * RECOMMENDATION:  Install a fix pack or interim fix that      *
  *                  contains this APAR.                         *
  ****************************************************************
  The OpenID Connect (OIDC) TAI is unable obtain a JWK from the
  jwkEndpointUrl using basic authentication.  If a JWK endpoint
  requires basic authentication, the endpoint cannot be used.
  

Problem conclusion

• The following properties are added to the OIDC TAI to provide
  basic authentication support for the JWK endpoint:
  
  provider_(id).jwkClientId
  Values: there is no default value
  Description: Specifies the client identifier to include in the
  basic authentication scheme of the JWK request.
  
  provider_(id).jwkClientSecret
  Values: there is no default value
  Description: Specifies the client password to include in the
  basic authentication scheme of the JWK request.
  
  When these OIDC TAI properties are configured for a provider, a
  basic authentication header will be included in the request to
  the JWK endpoint.
  
  The fix for this APAR is targeted for inclusion in fix packs
  8.5.5.19 and 9.0.5.6. For more information, see 'Recommended
  Updates for WebSphere Application Server':
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels

• R850 PSY

     UP

• R900 PSY

     UP