PI32293: SAML WEB SSO TAI IS NOT WORKING WHEN IDP CERTIFICATE RENEWED

Fixes are available

APAR status

Closed as program error.

Error description

The SAML WEB SSO TAI is not working when an IdP certificate is
renewed. After updating a certificate on Websphere application
server, a server restart is required to make the SAML TAI
recognize the update.

Local fix

```
restart the websphere
```

Problem summary

****************************************************************
* USERS AFFECTED:  IBM WebSphere Application Server            *
*                  administrators of SAML web single sign-on   *
*                  (SSO)                                       *
****************************************************************
* PROBLEM DESCRIPTION: SAML web SSO does not recognize         *
*                      updates to the trust store that         *
*                      are made after the application server   *
*                      has started.                            *
****************************************************************
* RECOMMENDATION:  Install a fix pack that contains this       *
*                  APAR.                                       *
****************************************************************
If, after the application server is started, an Identity
Provider (IdP) certificate is updated in the trust store
configured for the SAML web single sign-on service provider
(SP), evaluation of trust will fail for the IdP using the new
certificate.

Problem conclusion

The SAML web single sign-on (SSO) runtime loads a trust store
only once and that trust store instance is used across
requests until the server is restarted.  If the trust store is
updated after it is loaded, the updates to the trust store
are not be recognized by the SAML web SSO runtime until the
application server restarts.

The SAML web SSO runtime is updated to allow a trust store to
be updated while the application server is running. A custom
property is added that enables the runtime to reload the trust
store after trust validation has failed.  This action can only
be performed once per request.

Set the following SAML web SSO TAI custom property to true to
enable reloading of the trust store across all SPs:

retryOnceAfterTrustFailure=true

The property can be scoped to specific SPs using this custom
property:

sso_<id>.sp.retryOnceAfterTrustFailure=true


The fix for this APAR is currently targeted for inclusion in
fix packs 7.0.0.39, 8.0.0.11, and 8.5.5.6.  Please refer to
the Recommended Updates page for delivery information:
http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980

Keywords: IBMWL3WSS, SAMLWSSO

Temporary fix

Comments

APAR Information

APAR number
PI32293
Reported component name
WEBSPHERE APP S
Reported component ID
5724J0800
Reported release
850
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt / Xsystem
Submitted date
2015-01-07
Closed date
2015-02-12
Last modified date
2015-09-09

APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name
WEBSPHERE APP S
Fixed component ID
5724J0800

Applicable component levels

R700 PSY
UP
R800 PSY
UP
R850 PSY
UP

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"8.5","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
28 April 2022

Tips

PI32293: SAML WEB SSO TAI IS NOT WORKING WHEN IDP CERTIFICATE RENEWED

Fixes are available

Subscribe

APAR status

Closed as program error.

Error description

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

APAR number

Reported component name

Reported component ID

Reported release

Status

PE

HIPER

Special Attention

Submitted date

Closed date

Last modified date

APAR is sysrouted FROM one or more of the following:

APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name

Fixed component ID

Applicable component levels

R700 PSY

R800 PSY

R850 PSY

Document Information

Share your feedback

Need support?