PH51805: ADMINTASK.IMPORTSAMLIDPMETADATA EMITS SECJ8043E WHEN IDP EXISTS ANYWHERE

APAR status

• Closed as program error.

Error description

• AdminTask.importSAMLIdpMetadata emits a SECJ8043E error when
  an idp exists anywhere in the SAML TAI configuration instead
  of just within the same SP config group.
  
  [1/5/23 9:50:19:496 CST] 000000bf SamlCommandPr 3
  importSAMLIdpMetadata caught an unexpected exception
  
  com.ibm.websphere.management.cmdframework.CommandException:
  SECJ8043E: https://idp.acme.com/saml/sps/saml20ip/saml20
  already exists in
  the SAML TAI IdP security configuration.
  at
  com.ibm.ws.security.saml.admintask.SamlCommandProviderImpl.isEle
  mentAlreadyExist(SamlCommandProviderImpl.java:1141)
  at
  com.ibm.ws.security.saml.admintask.SamlCommandProviderImpl.impor
  tSAMLIdpMetadata(SamlCommandProviderImpl.java:138)
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native
  Method)
  at
  sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessor
  Impl.java:90)
  at
  sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethod
  AccessorImpl.java:55)
  at java.lang.reflect.Method.invoke(Method.java:508)
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server                                      *
  ****************************************************************
  * PROBLEM DESCRIPTION: importSAMLIdpMetadata emits a SECJ8043E *
  *                      error when an idp exists anywhere in    *
  *                      the                                     *
  *                      SAML TAI configuration.                 *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  AdminTask.importSAMLIdpMetadata emits a SECJ8043E error when
  an idp exists anywhere in the SAML TAI configuration instead
  of just within the same SP config group.
  For example, if the URL for the IdP that is defined in
  /tmp/idpdata.xml is https://idp.aluminum.com/login, and you have
  the following SAML TAI config attributes:
  sso_1.idp_1.SingleSignOnUrl=https://idp.foil.com/login
  sso_1.idp_2.SingleSignOnUrl=https://idp.tin.com/login
  sso_2.idp_1.SingleSignOnUrl=https://idp.aluminum.com/login
  When you run the following command, a SECJ8043E error is emitted
  when it should not:
  AdminTask.importSAMLIdpMetadata('-idpMetadataFileName
  /tmp/idpdata.xml -ssoId 1 -signingCertAlias idpcert')
  

Problem conclusion

• The AdminTask.importSAMLIdpMetadata command is updated so that
  it only emits a SECJ8043E if an IdP exists in the target SP
  config group.
  
  Using the previous example, a SECJ8043E occurs when the command
  is run with the following SAML TAI attributes:
  
  sso_1.idp_1.SingleSignOnUrl=https://idp.foil.com/login
  sso_1.idp_2.SingleSignOnUrl=https://idp.tin.com/login
  sso_1.idp_3.SingleSignOnUrl=https://idp.aluminum.com/login
  
  
  The fix for this APAR is targeted for inclusion in fix pack
  8.5.5.24 and 9.0.5.15. For more information, see 'Recommended
  Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels