PH43169: OIDCCLIENTHELPER.GETACCESSTOKENFROMSUBJECT() MIGHT RETURN NULL WHEN USING JWT SSO

APAR status

• Closed as program error.

Error description

• OidcClientHelper.getAccessTokenFromSubject() might return null
  when using JWT SSO. Sample trace:
  
  [1/3/22 16:14:00:668 CET] 00000129 OidcHelper  3  Subject:
  Subject:
  Principal: ldap1:389/a_principal
  Public Credential:
  com.ibm.ws.security.auth.WSCredentialImpl@86794a4a
  Private Credential:
  {com.ibm.wsspi.security.cred.cacheKey=a_principal1175655451,
  refresh_token=, scope=openid profile realmname roles email,
  token_type=,
  com.ibm.wsspi.security.cred.securityName=a_principal,
  access_token=access_token_string, id_token=,
  setLtpaCookie=false}
  Private Credential:
  com.ibm.ws.security.token.SingleSignonTokenImpl@fddaa8a2
  Private Credential:
  com.ibm.ws.security.token.AuthenticationTokenImpl@6e1ac90a
  Private Credential:
  com.ibm.ws.security.token.AuthorizationTokenImpl@b3ef28ae
  [1/3/22 16:14:00:669 CET] 00000129 OidcHelper  3  Getting
  private credentials.
  [1/3/22 16:14:00:669 CET] 00000129 OidcHelper  3  Found a
  Hashtable in private creds.
  [1/3/22 16:14:00:669 CET] 00000129 OidcHelper  3  Could not find
  an OIDC hashtable in private creds.
  [1/3/22 16:14:00:670 CET] 00000129 OidcHelper  <
  getOidcHashtableFromSubject returns [null] Exit
  [1/3/22 16:14:00:670 CET] 00000129 OidcHelper  <
  getValueFromPrivateCreds returns [null] Exit
  [1/3/22 16:14:00:670 CET] 00000129 OidcHelper  <
  getAccessTokenFromSubject() returns [null] Exit
  
  This can happen when using WebSphere versions 9.0.5.9 or
  9.0.5.10 or OIDC v1.3.2.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  IBM WebSphere Application Server users of   *
  *                  OpenId Connect                              *
  ****************************************************************
  * PROBLEM DESCRIPTION: OidcClientHelper.getAccessTokenFromSubj *
  *                      ec                                      *
  *                      t() might return null when using JWT    *
  *                      SSO                                     *
  ****************************************************************
  * RECOMMENDATION:  Install a fix pack or interim fix that      *
  *                  contains this APAR                          *
  ****************************************************************
  After PH35481 was included in 9.0.5.9,
  OidcClientHelper.getAccessTokenFromSubject() might return null
  when using JWT SSO.
  

Problem conclusion

• The fix for APAR PH35481 was to check for an entry that must
  exist in the HashTable for the OIDC path.  However the old code
  was removed and the replacement code checks for an entry does
  not exist for the JWT SSO path.
  
  The code is updated so that it will check for either entry in
  the HashTable for identification.
  
  
  The fix for this APAR is targeted for inclusion in fix pack
  9.0.5.11 and OIDC 1.3.3. For more information, see 'Recommended
  Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels