PH30368: OIDC RP MAY NOT DELETE SESSION COOKIE WHEN SAMESITE COOKIE POLICY=LAX

PH39666: OIDC v1.3.2; OIDC RP: Initial login might fail when the OIDC stateId contains special characters

APAR status

• Closed as program error.

Error description

• If an the OpenID Connect (OIDC) Relying Party's
  (RP) configured OpendID Provider (OP) requires that the
  application use an end-session endpoint, there may be a
  problem deleting the OIDC session cookie at logout when
  SameSite=Lax.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server and OpenID Connect                   *
  ****************************************************************
  * PROBLEM DESCRIPTION: The OIDC RP may not delete its session  *
  *                      cookie upon logout when the SameSite    *
  *                      cookie policy is Lax.                   *
  ****************************************************************
  * RECOMMENDATION:  Do one of the following: 1) Set the         *
  *                  SameSite                                    *
  *                  cookie policy to none.  2) Install an       *
  *                  interim                                     *
  *                  fix or fix pack that contains this APAR.    *
  ****************************************************************
  If an RP's configured OP requires that the application use an
  end-session endpoint instead of having the RP revoke tokens
  itself, the RP may not be able to delete its session
  cookie when the SameSite cookie policy is Lax.
  

Problem conclusion

• If the OP is considered a 3rd party by the browser, when SameSit
  is set to Lax, the OIDC session cookie may not be available when
  the logout request is received from the OP and therefore the OID
  RP cannot find the cookie, then delete it.
  
  The OIDC RP is updated so that it will delete the session cookie
  upon logout for logout requests that can be matched by the TAI
  filter.
  
  The fix for this APAR is targeted for inclusion in fix packs
  8.5.5.19 and 9.0.5.7. For more information, see 'Recommended
  Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels

• R850 PSY

     UP

• R900 PSY

     UP