PH02361: WEBSPHERE LIBERTY OIDC CLIENT IMPLEMENTATION IS PROXY-UNAWARE

18.0.0.4: WebSphere Application Server Liberty 18.0.0.4
19.0.0.1: WebSphere Application Server Liberty 19.0.0.1
19.0.0.2: WebSphere Application Server Liberty 19.0.0.2
19.0.0.3: WebSphere Application Server Liberty 19.0.0.3
19.0.0.4: WebSphere Application Server Liberty 19.0.0.4
19.0.0.5: WebSphere Application Server Liberty 19.0.0.5
19.0.0.6: WebSphere Application Server Liberty 19.0.0.6
19.0.0.7: WebSphere Application Server Liberty 19.0.0.7
19.0.0.8: WebSphere Application Server Liberty 19.0.0.8
19.0.0.9: WebSphere Application Server Liberty 19.0.0.9
19.0.0.10: WebSphere Application Server Liberty 19.0.0.10
19.0.0.11: WebSphere Application Server Liberty 19.0.0.11
19.0.0.12: WebSphere Application Server Liberty 19.0.0.12
20.0.0.1: WebSphere Application Server Liberty 20.0.0.1
20.0.0.2: WebSphere Application Server Liberty 20.0.0.2
20.0.0.3: WebSphere Application Server Liberty 20.0.0.3
20.0.0.4: WebSphere Application Server Liberty 20.0.0.4
20.0.0.5: WebSphere Application Server Liberty 20.0.0.5

APAR status

• Closed as program error.

Error description

• The OpenID Connect (OIDC) client is not able to use the
  https.proxyHost and https.proxyPort settings in the JVM when
  communicating with the OpenID Connect provider.  Each URL in
  the OIDC configuration must route to the proxy host/port,
  then the team that manages the proxy, must set up a routing
  rule for the endpoints that need to go through the proxy to
  the OP.
  
  This requirement can present an administrative problem for
  customers.
  

Local fix

• L3 is building test fix.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  IBM WebSphere Application Server Liberty    *
  *                  administrators of OpenID Connect            *
  ****************************************************************
  * PROBLEM DESCRIPTION: The OpenID Connect client does not      *
  *                      honor the https.proxyHost and           *
  *                      https.proxyPort JVM properties          *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  The OpenID Connect client does not allow an administrator to use
  the http(s).proxyHost and http(s).proxyPort JVM properties to
  route HTTP requests that it makes through a proxy.
  

Problem conclusion

• The OpenID Connect client runtime is updated to allow an
  administrator to use the http(s).proxyHost and http(s).proxyPort
  settings in the JVM to route HTTP requests that it makes through
  a proxy.  To use the proxy settings, set the following attribute
  on your openidConnectClient configuration:
  
  useSystemPropertiesForHttpClientConnections=true
  
  This attribute is added to the following component
  configurations:
  openidConnectClient
  jwtConsumer
  mpJwt
  googleLogin
  twitterLogin
  facebookLogin
  githubLogin
  linkedinLogin
  oauth2Login
  oidcLogin
  
  
  The fix for this APAR is currently targeted for inclusion in fix
  pack 18.0.0.4.  Please refer to the Recommended Updates page for
  delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WAS LIBERTY COR

• Fixed component ID

  5725L2900

Applicable component levels

• R855 PSY

     UP