PH25774: OIDC RP: SESSION COOKIE VALUE IS TOO SHORT

PH29099: OIDC v1.3.1; OIDC RP: ClassNotFoundException for JsonUtil$DupeKeyDisallowingLinkedHashMap
PH39666: OIDC v1.3.2; OIDC RP: Initial login might fail when the OIDC stateId contains special characters

APAR status

• Closed as program error.

Error description

• The value for the OpenID Connect session cookie, OIDCSESSIONID,
  is only about 9 random numeric characters.  Some administrators
  want this value to be longer.
  

Local fix

• n/a
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server                                      *
  ****************************************************************
  * PROBLEM DESCRIPTION: The value for the OIDC session cookie   *
  *                      is only about 9 random numeric          *
  *                      characters.  This value could be        *
  *                      longer.                                 *
  ****************************************************************
  * RECOMMENDATION:  Install a fix pack or interim fix that      *
  *                  contains this APAR.                         *
  ****************************************************************
  The value for the OpenID Connect (OIDC) trust
  association interceptor (TAI) session cookie, OIDCSESSIONID,
  is only about 9 random numeric characters.  Some administrators
  want this value to be longer.
  

Problem conclusion

• The OIDC TAI has a random value calculator that produces a
  long random value, then runs that value through a reducer to
  preseve cookie 'space'.
  
  The OIDC TAI is updated so that the value for the session
  cookie is not run through the ruducer and results in a session
  cookie value that is about 44 mixed-case alpha numeric
  characters.  For instance:
  19184QffcDIVgp5KgkeLC3/RSLyf8nS75Dtt4GyQaYw=.
  
  The fix for this APAR is targeted for inclusion in fix
  packs 8.5.5.18 and 9.0.5.5. For more information, see
  'Recommended Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels

• R850 PSY

     UP

• R900 PSY

     UP