PH47550: SAML: ADD USEJAVASCRIPT PROPERTY TO REPLACE REDIRECTTOIDPONSERVERSIDE FOR BETTER UNDERSTANDING

APAR status

• Closed as program error.

Error description

• There are at least three properties that the WebSphere single
  sign-on components use to mean "use JavaScript when redirecting
  to the provider": redirectToIdPonServerSide,
  isClientSideRedirectSupported, and useJavaScript.  The one that
  the SAML Web SSO component in WebSphere Application Server uses
  is redirectToIdPonServerSide.  The name of this property does
  not convey what it does and the property can be  confusing to
  both customers and support personnel.  There should be a
  property provided that has a better name.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server and SAML web SSO                     *
  ****************************************************************
  * PROBLEM DESCRIPTION: Add SAML web SSO useJavaScript custom   *
  *                      property to replace                     *
  *                      redirectToIdPonServerSide               *
  ****************************************************************
  * RECOMMENDATION:  Install a fix pack or interim fix that      *
  *                  contains this APAR.                         *
  ****************************************************************
  The meaning of the SAML web SSO property,
  sso_<id>.sp.redirectToIdPonServerSide, can be confusing to
  customers and support personnel.
  

Problem conclusion

• A new property is introduced to the SAML web SSO TAI called
  useJavaScript.  The useJavaScript property means to use
  JavaScript when the TAI redirects a login request to an IdP.
  
  The meaning of the true and false values of the useJavaScript
  property are opposite of those for the redirectToIdPonServerSide
  property.  However, the default behavior of the runtime is the
  same regardless of which property you use.  That is,
  redirectToIdPonServerSide defaults to true and useJavaScript
  defaults to false.
  
  The following custom properties are added to the SAML web SSO
  TAI:
  
  =========================
  sso_<id>.sp.useJavaScript
  
  Values: true/false(default)
  
  Description:
  When this property is set to true, the TAI uses JavaScript when
  a request is redirect to an IdP.  When you do not use
  JavaScript, any fragments that are present on the original
  inbound request are lost.
  
  When the sso_<id>.sp.login.error.page property is set to a class
  name to implement SP-Initiated SSO, the value for this property
  is ignored.  When this property is set to a value, the value for
  the sso_<id>.sp.redirectToIdPonServerSide property is ignored.
  
  =========================
  useJavaScript
  
  Values: true/false(default)
  
  Description:
  
  When this property is set to true, the TAI uses JavaScript when
  a request is redirect to an IdP.  When you do not use
  JavaScript, any fragments that are present on the original
  inbound request are lost.
  
  When the sso_<id>.sp.login.error.page property is set to a class
  name to implement SP-Initiated SSO, the value for this property
  is ignored.  When this property is set to a value, the value for
  the redirectToIdPonServerSide property is ignored.
  
  The fix for this APAR is targeted for inclusion in fix pack
  8.5.5.23 and 9.0.5.14.  For more information, see 'Recommended
  Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels