CWTAI

CWTAI0001I: Trust Association Interceptor initialization started.
CWTAI0003E: An unexpected exception occurred in the Trust Association Interceptor: {0}.
CWTAI0006I: Trust Association Interceptor initialization is complete. Configuration follows:
{0}
CWTAI0009E: Trust Association Interceptor configuration is not valid. Failure condition: {0}. If you are not using the TAI, you can ignore this message.
CWTAI0011E: A non-valid token has been encountered while authenticating a HttpServletRequest: {0}
CWTAI0012E: A null string is not a valid filtering rule for the Trust Association Interceptor.
CWTAI0018E: Filter condition is malformed. s1 = {0}; s2 = {1}; s3 = {2}
CWTAI0019E: Filter operator should be one of ""=="", ""!="", ""%="", "">"" or ""<"". Operator used was {0}.
CWTAI0020E: Unexpected internal condition: {0}.
CWTAI0021E: No delegated credentials were found for user: {0}.
CWTAI0022E: Expected error. No LTPA Token found for: {0}. Redirection will not be attempted to avoid an infinite redirection loop.
CWTAI0023I: User name {0} Token size {1}.
CWTAI0024E: An error occurred during the reloading of the TAI Properties. The previously properties are in effect.
CWTAI0025I: Reload of the TAI Properties is complete. Active configuration:
{0}
CWTAI0026I: Reload of the TAI Properties is not needed. The file has not changed since the last reload.
CWTAI0027I: Trust Association Interceptor is {0}.
CWTAI0028W: Unable to load html content from {0}, will use default content. Exception: {1}.
CWTAI0033I: TAI property {0} has been added to the security configuration, its value is: {1}.
CWTAI0034I: TAI property {0} has been modified in the security configuration, its new value is: {1}, the previous value was: {2}.
CWTAI0035I: TAI property {0} has been removed from the TAI configuration.
CWTAI0036I: All TAI properties have been removed from the security configuration.
CWTAI0037E: spnId {0} is not valid, specify a non-negative value.
CWTAI0041E: Filter {0} is malformed, verify syntax of the specified filter rules.
CWTAI0042E: One of the URLs specified is malformed.
CWTAI0043E: An error occurred during the initialization of the reloaded TAI Properties.
CWTAI0045E: Cannot convert the IP string {0} to an IP address.
CWTAI0046E: Malformed IP range specified. Found {0} rather than a wildcard.
CWTAI0047E: Unknown host exception raised for IP address {0}.
CWTAI0048E: Authentication Error: OAuth access token is not present. Please login to the OAuth service provider, and try again.
CWTAI0049E: Custom property string {0} is not formatted correctly.
CWTAI0050E: Security domain {0} does not exist.
CWTAI0051E: The OAuth Provider {0} is not configured correctly. The error occurred while processing URL {1}
CWTAI2001E: The OpenID Connect relying party (RP) failed to initialize because the value for the mandatory property [{0}] is missing or empty.
CWTAI2002E: The OpenID Connect relying party (RP} failed to initialize because the value of the optional property redirectToRPHostAndPort [{0}] is not valid. The valid value should be of format [protocol://host:port]
CWTAI2003E: The OpenID Connect relying party (RP) failed to initialize because the value of optional property signatureAlgorithm [{0}] is not valid or is not supported. The supported algorithms are [{1}].
CWTAI2004E: The OpenID Connect relying party (RP) failed to initialize because the value of optional property opServerConnectionTimeout [{0}] is not a valid number.
CWTAI2005E: The OpenID Connect relying party (RP) failed to initialize because the [{0}] property is encoded by using the [{1}] algorithm and that encoding algorithm is not supported. The value for the {0} property can be in plain text or encoded by using the XOR algorithm.
CWTAI2006W: The OpenID Connect relying party (RP) received a callback from during the login sequence. The callback request [{0}] is not to a valid URL. It will be ignored.
CWTAI2007E: The OpenID Connect relying party (RP) encountered a failure during the login. The exception is [{0}]. Check the logs for details that lead to this exception.
CWTAI2008E: The OpenID Connect relying party (RP) received an error [{0}] for the state id [{1}] during the login sequence.
CWTAI2009I: The OpenID Connect relying party (RP) did not find an entry for session cookie {0} in the Session cache.
CWTAI2010I: The OpenID Connect relying party (RP) attempted to refresh an expired access token for session cookie [{0}]. The attempt failed because of exception [{1}]
CWTAI2011E: The OpenID Connect relying party (RP) could not authenticate the token [{0}] using implicit client authentication. The error or exception it encountered was [{1}]
CWTAI2012E: The OpenID Connect relying party (RP) received a bearer token in the authorization header of the http request but the token is incorrectly formatted or missing.
CWTAI2013E: The OpenID Connect relying party (RP) failed to authenticate the user using access token [{0}] because [{1}].
CWTAI2014E: The OpenID Connect relying party (RP) failed to initialize because the value of the optional property [{0}] specified as [{1}] is not a valid number.
CWTAI2015E: The OpenID Connect relying party (RP) failed to perform authentication because it has reached the maximum capacity of its internal cache.
CWTAI2016E: Filter operator should be one of ==, !=, %=, > or <. Operator used was {0}.
CWTAI2017E: The [{0}] OpenID Connect relying party (RP) TAI custom property has a value, [{1}], that is not supported. The value for the [{0}] custom property must contain the string "{2}". For example: "{2} general".
CWTAI2018E: The OpenID Connect relying party (RP) was unable to retrieve the public certificate for the [{0}] alias from the default trust store. The cause of the error is: [{1}].
CWTAI2019E: The state id [{0}] in the OpenID Connect relying party (RP) state cookie [{1}] does not match the state id [{2}] received from the OpenID Connect provider.
CWTAI2020W: The size [{0}] calculated for the OpenID Connect relying party (RP) state cookie is larger than allowed cookie size [{1}]. The cookie will not be created.
CWTAI2021W: The OpenID Connect relying party (RP) TAI is configured with a combination of custom properties that may render the component inoperable: {0}
CWTAI2022E: The OpenID Connect relying party (RP) TAI failed to initialize. The TAI is configured with a combination of custom properties that will make the component inoperable: {0}
CWTAI2023I: [{0}] is set to [{1}], but [{2}] is set to or has defaulted to [{3}].
CWTAI2024I: [{0}] is set to [{1}], but [{2}] is set to [{3}].
CWTAI2025I: [{0}] is set to [{1}], but [{2}] is set to or defaulted to [{3}], which is less than the minimum [{4}].
CWTAI2028W: The OpenID Connect test fix will stop taking requests on [{0}].
CWTAI2029I: [{0}] is set to [{1}], which is less than the minimum [{2}].
CWTAI2030I: The OpenID Connect TAI was unable to retrieve the request data with stateId [{0}] from the state map. It may have expired.
CWTAI2031E: The OpenID Connect state cookie [{0}] does not exist on the HTTP request.
CWTAI2032I: [{0}] is set to [{1}], but [{2}] is set to [{3}], which is out of range. The minimum value must be between [{4}] and [{5}].
CWTAI2033W: The OpenID Connect relying party TAI custom property [{0}] is set to [{1}]. This setting is only valid when an application server has DynaCache enabled. DynaCache is not enabled on this application server. [{0}] is reverting to its default setting: [{2}].
CWTAI2034W: The JNDI Cache name [{0}] that is specified on the OpenID Connect custom property [{1}] does not appear to be accessible at this time [{2}]. The OIDC RP will continue to initialize because the cache may become available at a later time. The OIDC RP will attempt to access the JNDI cache again when the first request is received. If the JNDI cache is not available at that time, the RP will revert to using an alternate caching method instead of the JNDI cache requested.
CWTAI2035W: A JNDI Cache name [{0}] was specified on the OpenID Connect custom property [{1}] but DynaCache does not appear to be enabled on the application server. The OIDC RP will continue to initialize. The OIDC RP will attempt to access DynaCache again when the first request is received. If DynaCache is not available at that time, the RP will revert to using an alternate caching method instead of the JNDI cache requested.
CWTAI2037W: The OpenID Connect relying party (RP) is unable to use the JNDI cache [{0}] that was specified on the OpenID Connect custom property [{1}]. An alternate caching method will be used. [{2}]
CWTAI2038I: DynaCache is not active on the application server.
CWTAI2039I: Unable to locate the JNDI cache [{0}]. {1}
CWTAI2040I: [{0}] is set to [{1}], which is greater than the maximum [{2}].
CWTAI2041W: The OpenID Connect TAI custom property, [{0}], is set to [{1}], but the dynamic cache service (DynaCache) is not enabled on this application server. [{0}] can only be set to [{1}] when the dynamic cache service is in use. The setting for [{0}] will be ignored. This property can be set to a number in the range [{2} - {3}].
CWTAI2042E: The current Java version is [{0}]. The OpenID Connect TAI requires Java version [7] or later. The value of the [{1}] system property is [{2}]. The OpenID Connect TAI will not intercept requests.
CWTAI2043E: The OpenID Connect TAI cannot determine the Java version so it will not intercept requests. The value of the [{0}] system property is [{1}]. {2}
CWTAI2044E: The OpenID Connect TAI cannot determine the Java version so it will not intercept requests. The [{0}] system property is not set to a value. This property is set by the Java runtime.
CWTAI2045E: The OpenID Connect Trust Association Interceptor (TAI) cannot perform authentication because a JSON Web Token (JWT) cannot be found in the request.
CWTAI2046E: The authentication request failed because the JSON Web Token (JWT) does not contain the [{0}] claim that the [{1}] OpenID Connect TAI custom property specified.
CWTAI2047E: No key was found to verify the signature. The signature algorithm is [{0}]. The JWT [kid] claim value is [{1}] and the [x5t] claim value is [{2}]. The [jwkEndpointUrl] is [{3}]. The [signVerifyAlias] property value is [{4}]. {5}
CWTAI2048E: The JSON Web Token (JWT) or ID token signature is not valid. {0}
CWTAI2049E: The [{0}] claim value of [{1}] that is converted to [{2}] must be equal to or later than the current time of [{3}].
CWTAI2050E: The JSON Web Token (JWT) or ID token is not valid because the issued at [iat] claim specifies a date later than the current time. The [iat] claim time is [{0}]. The current time plus the clock skew is [{1}]. The configured clock skew is [{2}] seconds.
CWTAI2051E: A JSON Web Token (JWT) with the same [iss] claim of [{0}] and [jti] claim of [{1}] was already received, which might indicate a replay attack. Ensure that the token issuer provides a token with a unique [jti] claim.
CWTAI2052E: A JSON Web Key (JWK) was not returned from the [{0}] URL. The response status was [{1}] and the content returned was [{2}].
CWTAI2053E: The OpenID Connect Trust Association Interceptor (TAI) was unable to retrieve JSON Web Key (JWK) from the [{0}] URL. {1}
CWTAI2054E: The issuer of the provided JSON Web Token (JWT) is not trusted. {0}
CWTAI2055E: The [{0}] audience of the provided JSON Web Token (JWT) is not in the trusted audiences list. The trusted audiences are [{1}]. If you trust this audience, make sure that the trusted audience list that is set on the [provider_<id>.audiences] OIDC TAI property contains the value for the "aud" claim in the token. Alternatively, set the OIDC TAI property to the ALL_AUDIENCES value.
CWTAI2056E: The JSON Web Token (JWT) or ID token is not valid because the issued at [iat] claim specifies a date later than its expiration [exp] claim. The [iat] claim time is [{0}] and the [exp] claim time is [{1}].
CWTAI2057E: The JSON Web Token (JWT) is not valid because its expiration the [exp] claim is either missing or the token expired. The expiration claim is [{0}]. The current time minus the clock skew is [{1}]. The configured clock skew is [{2}] seconds.
CWTAI2058E: The JSON Web Token (JWT) or ID token cannot be used because the [nbf] claim value of [{0}] specifies a time that is later than the current time. The current time plus the clock skew is [{1}]. The configured clock skew is [{2}] seconds.
CWTAI2059E: The JSON Web Token (JWT) or ID token is not valid because it was signed by using the [{0}] algorithm. Tokens are required to be signed with the [{1}] algorithm.
CWTAI2060E: The resource server failed the authentication request because the OpenID Connect TAI property of [{0}] does not contain the value for the [iss] claim of [{1}] in the JSON Web Token (JWT). The allowed issuers are [{2}].
CWTAI2061E: The OpenID Connect relying party (RP) failed to initialize because the value of optional property [{0}] is set to [{1}], which is not one of the supported values [{2}].
CWTAI2062E: The request to the OpenID Connect provider URL, [{0}], failed. [{1}]
CWTAI2063E: The OIDC TAI must initiate a connection with the default SSL socket factory and that socket factory must be the WebSphere SSL socket factory. The current default SSL socket factory is [{0}], but the OIDC TAI expects the WebSphere SSL socket factory, [{1}].
CWTAI2064E: The OIDC TAI is not able to obtain an SSL socket factory. [{0}]
CWTAI2065E: The [iss] claim, [{0}], in the ID token does not match value for the [provider_(id).issuerIdentifier] property, [{1}], in the OIDC TAI configuration.
CWTAI2066E: The JSON Web Token (JWT) contains the [iss] claim, [{0}], but the OIDC TAI is configured to reject a JWT that contains an (iss) claim. Consider setting [provider_(id).verifyIssuerInIat] to [true].
CWTAI2067E: The required [iat] claim is not present in the token.
CWTAI2068E: The (aud) audience, [{0}], specified in the token does not match the value for the [provider_(id).clientId] property, [{1}], in the OIDC TAI configuration.
CWTAI2069E: The (azp) authorized party, [{0}], specified in the token does not match the value for the [provider_(id).clientId] property, [{1}], in the OIDC TAI configuration.
CWTAI2070E: The token does not contain an [aud] claim. The TAI is configured to trust only the following audiences: [{0}]
CWTAI2071E: The JWT cannot be verified. The reason for the error is: {0}
CWTAI2072E: The runtime cannot find an issuer to verify the JWT. The JWT does not include an "iss" claim and no default issuer is available to the method.
CWTAI2073E: The runtime cannot find an OIDC TAI configuration entry that is associated with the [{0}] issuer. The "iss" claim in the JWT is [{1}]. The default issuer is [{2}].
CWTAI2074E: The [{0}] iss claim value in the JWT not does match the [{1}] issuer value of the OpenID Provider.
CWTAI2075E: The JWT cannot be used because the nbf claim value of [{0}] specifies a time that is later than the current time. The current time plus the clock skew is [{1}]. The configured clock skew is [{2}] seconds. The clock skew cannot be changed when a JWT is validated by using discovery.
CWTAI2076E: The token cannot be decrypted because {0}: {1}.
CWTAI2077E: The token is encrypted, but there is no decrypting key available to decrypt the token. Verify that the [{0}] OIDC TAI properties are correct.
CWTAI2078E: The token is encrypted, but the token does not contain a JsonWebEncryption part. The JsonWebEncryption part is required.
CWTAI2079E: The TAI cannot to decode the value for the {0} property. The reason is: {1}
CWTAI2080W: In the authorization header of the HTTP request, the OIDC TAI received a bearer token in JSON Web Encryption (JWE) format. The OIDC TAI is not configured to decrypt the token. The [{0}] OIDC TAI properties are required to decrypt a JWE. A token in JWE format has five parts.
CWTAI2081E: The OIDC TAI has nonce enabled but the nonce verification failed. The nonce [{0}] in the token does not match the nonce, [{1}], that was specified in the request to the OpenID Connect provider.
CWTAI2082W: The OIDC TAI cannot load the keystore {0}. {1}. Encrypted JWTs cannot be decrypted. Any encrypted JWTs that the TAI receives are rejected.
CWTAI2083W: The OIDC TAI cannot load the decrypting key with alias "{0}" from the keystore {1}. {2} Encrypted JWTs cannot be decrypted. Any encrypted JWTs that the TAI receives are rejected.
CWTAI2084E: The OIDC TAI cannot retrieve the key with alias "{0}" from the {1} keystore. The reason is: {2}
CWTAI2085E: The entry with alias "{0}" of keystore {1} cannot be used for decryption. The entry type for the alias is not KeyEntry or SecretKeyEntry.
CWTAI2086E: The OIDC TAI failed to validate the ID token due to [{0}]
CWTAI2087E: The OIDC TAI failed to validate the JSON Web Token due to [{0}]
CWTAI2088E: The OIDC TAI cannot verify the response from the {0} endpoint, {1}. {2}
CWTAI2089E: The response is not in JSON format. {0}
CWTAI2090E: The value for the sub claim in the response from the UserInfo endpoint does not match the value for the sub claim in the ID token. The value for the sub claim in the response from the UserInfo endpoint is {0}. The value for the sub claim in the ID token is {1}.
CWTAI2091E: The sub claim is not present in the UserInfo response, or it has an empty value.
CWTAI2092E: The sub claim is not present in the ID token, or it has an empty value.
CWTAI2093E: Both the {0} and {1} OIDC TAI custom properties are specified. Although both properties are valid, only one is allowed, not both.
CWTAI2094E: The [{0}] OIDC TAI property is set to [{1}] and contains the [{2}] value. [{2}] is not allowed in the list of values for the [{0}] property.
CWTAI2095E: The [provider_{0}] OpenID Connect Trust Association Interceptor provider configuration does not contain at least one of the following properties: [{1}]. The configuration for this provider is not active for processing requests.
CWTAI2096E: The OpenID Connect Trust Association Interceptor configuration does not contain at least one of the following properties: [{0}]. The OIDC TAI is not active for processing requests.
CWTAI2097E: Cannot convert the IP string [{0}] to an IP address.
CWTAI2098E: The scheme of the [{0}] inbound request is not HTTP or HTTPS. The OIDC TAI is unable to process the request. Consider using the provider_<id>.redirectToRPHostAndPort OIDC TAI property to prevent this error by overriding the request scheme requirement.
CWTAI2099W: The OIDC TAI cannot retrieve the [{0}] method from the [{1}] class: {2}
CWTAI2100W: The OIDC TAI cannot apply the SameSite attribute to the [{0}] cookie: {1}
CWTAI2101W: The OIDC TAI cannot apply the SameSite attribute string to the JavaScript [{0}]: {1}
CWTAI2102W: The OIDC TAI cannot evaluate the value for the [{0}] claim in the JWT: {1}
CWTAI2103W: The OIDC TAI cannot retrieve the SessionData object from the cache by using the [{0}] {1}: {2}
CWTAI2104W:Only one OIDC TAI provider configuration with the [provider_(id).grantType] property set to the [{0}] value is allowed. The [provider_{1}] configuration is ignored.
CWTAI2105W:The OIDC TAI [provider_{0}] configuration is replacing the [provider_{1}] configuration. A provider with the provider_(id).grantType property set to [all] overrides all other grantType entries.
CWTAI2107E: No claims were obtained from the id_token.
CWTAI2108E: None of the following claims are present in the JWT: [{0}]
CWTAI2109E: The TAI cannot obtain the [{0}] claim from the JWT: {1}
CWTAI2110E: The [{0}] [iss] claim in the JWT is not in the list of trusted issuers that is configured in the provider_(id).issuerIdentifier property in the OIDC TAI configuration. The list of trusted issuers is [{1}].
CWTAI4001E: The SAML web inbound Trust Association Interceptor (TAI) did not initialize because the value for the required property [{0}] is missing or empty.
CWTAI4002E: The SAML web inbound Trust Association Interceptor (TAI) did not initialize because the value of the signatureAlgorithm property [{0}] is not supported. The supported algorithms are [{1}].
CWTAI4003E: The validation of the Security Assertion Markup Language (SAML) token failed because the token could not be decoded. The reason for the error is [{0}].
CWTAI4004E: The validation of the Security Assertion Markup Language (SAML) token failed because the SAML Assertion was signed using the RSA-SHA1 signature algorithm, but the TAI was configured to allow only RSA-SHA256 signature algorithm.
CWTAI4005E: The validation of the Security Assertion Markup Language (SAML) token failed because none of the URI audiences allowed by the TAI were found in the <AudienceRestriction> audiences of the received SAML Assertion.
CWTAI4006E: The user name was not found in the SAML Assertion.
CWTAI4007E: The realm name was not found in the SAML Assertion.
CWTAI4008E: The unique identity was not found in the SAML Assertion.
CWTAI4009I: The configuration specifies [{0}={1}].
CWTAI4010E: The SAML Assertion does not contain a [{0}] element with a [{1}] attribute whose value is [{2}].
CWTAI4011E: The SAML Assertion contains a [{0}] [{1}] element with an [{2}] sub-element that is missing or empty.
CWTAI4012E: The SAML Assertion contains a [{0}] [Attribute] element with more than one [AttributeValue] sub-elements.
CWTAI4013E: The SAML web inbound Trust Association Interceptor (TAI) did not initialize. {0}
CWTAI4014E: At least one of the following required TAI custom properties must be specified [{0}]. None of these properties were included in the list of SAML web inbound TAI custom properties.