PI33449: FULL PROFILE OPENID CONNECT RP DOES NOT WORK WITH GOOGLE OP

PI47460: Add multi-provider support to OpenID Connect Relying Party in the full profile
8.5.5.8: WebSphere Application Server V8.5.5 Fix Pack 8
8.0.0.12: WebSphere Application Server V8.0 Fix Pack 12
8.5.5.9: WebSphere Application Server V8.5.5 Fix Pack 9
PI55697: OpenID Connect Relying Party : No entry in cache for stateid
8.5.5.10: WebSphere Application Server V8.5.5 Fix Pack 10
8.5.5.11: WebSphere Application Server V8.5.5 Fix Pack 11
8.0.0.13: WebSphere Application Server V8.0 Fix Pack 13
8.5.5.12: WebSphere Application Server V8.5.5 Fix Pack 12
8.0.0.14: WebSphere Application Server V8.0 Fix Pack 14
8.5.5.13: WebSphere Application Server V8.5.5 Fix Pack 13
8.0.0.15: WebSphere Application Server V8.0 Fix Pack 15
PI96508: OIDC v1.05; OIDC RP may not connect to token endpoint due to SSL handshake failure
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14
8.5.5.15: WebSphere Application Server V8.5.5 Fix Pack 15
PH08804: OIDC v1.1.0; OIDC RP default identifiers are not available when customs are configured
PH13175: OIDC v1.2.0; OIDC RP tokens are not revoked when sessions are evicted from the cache
8.5.5.17: WebSphere Application Server V8.5.5 Fix Pack 17
PH29099: OIDC v1.3.1; OIDC RP: ClassNotFoundException for JsonUtil$DupeKeyDisallowingLinkedHashMap
8.5.5.20: WebSphere Application Server V8.5.5.20
8.5.5.18: WebSphere Application Server V8.5.5 Fix Pack 18
8.5.5.19: WebSphere Application Server V8.5.5 Fix Pack 19
PH39666: OIDC v1.3.2; OIDC RP: Initial login might fail when the OIDC stateId contains special characters
8.5.5.16: WebSphere Application Server V8.5.5 Fix Pack 16
8.5.5.21: WebSphere Application Server V8.5.5.21

APAR status

• Closed as program error.

Error description

• The WebSphere Application Server full profile OpenID Connect
  RP will not work with Google's OP due to
  implementation-specific issues
  

Local fix

• N/A
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  IBM WebSphere Application Server users of   *
  *                  OpenID Connect relying party in the full    *
  *                  profile                                     *
  ****************************************************************
  * PROBLEM DESCRIPTION: Update the OpenID Connect RP TAI        *
  *                      in the full profile to support          *
  *                      interacting with the Google OP          *
  ****************************************************************
  * RECOMMENDATION:  Install a fix pack that contains this       *
  *                  APAR.                                       *
  ****************************************************************
  The current implementation of the OpenID Connect relying party
  (RP) Trust Association Interceptor (TAI) in the full profile
  does not support interacting with the Google OpenID
  Connect Provider (OP).
  

Problem conclusion

• The OpenID Connect relying party TAI is updated to support
  interacting with Google OpenID Connect Provider.
  
  To use the Google OP, you need to define the following TAI
  properties:
  
  jwkEndpointUrl=https://www.googleapis.com/oauth2/v2/certs
  issuerIdentifier=accounts.google.com
  signatureAlgorithm=RS256
  scope=openid profile email
  userIdentifier=email
  
  The fix for this APAR is currently targeted for inclusion in
  fix packs 8.0.0.12 and 8.5.5.8. Please refer to the
  Recommended Updates page for delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels

• R800 PSY

     UP

• R850 PSY

     UP