PI57465: OIDC: REMOVE SESSION COOKIE AFTER LOGOUT

PI57465: OIDC: Remove session cookie after logout ENABLEMENT FIXES
8.5.5.10: WebSphere Application Server V8.5.5 Fix Pack 10
8.5.5.11: WebSphere Application Server V8.5.5 Fix Pack 11
8.0.0.13: WebSphere Application Server V8.0 Fix Pack 13
8.5.5.12: WebSphere Application Server V8.5.5 Fix Pack 12
8.0.0.14: WebSphere Application Server V8.0 Fix Pack 14
8.5.5.13: WebSphere Application Server V8.5.5 Fix Pack 13
8.0.0.15: WebSphere Application Server V8.0 Fix Pack 15
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14
8.5.5.15: WebSphere Application Server V8.5.5 Fix Pack 15
8.5.5.17: WebSphere Application Server V8.5.5 Fix Pack 17
8.5.5.20: WebSphere Application Server V8.5.5.20
8.5.5.18: WebSphere Application Server V8.5.5 Fix Pack 18
8.5.5.19: WebSphere Application Server V8.5.5 Fix Pack 19
8.5.5.16: WebSphere Application Server V8.5.5 Fix Pack 16
8.5.5.21: WebSphere Application Server V8.5.5.21

APAR status

• Closed as program error.

Error description

• OIDC session cookie is not removed after logout.  You can still
  see the cookie in the browser after logout.
  

Local fix

• No
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  IBM WebSphere Application Server users of   *
  *                  OpenID Connect                              *
  ****************************************************************
  * PROBLEM DESCRIPTION: The OpenID Connect Relying Party does   *
  *                      not delete its cookies on logout        *
  ****************************************************************
  * RECOMMENDATION:  Install a fix pack that contains this APAR  *
  ****************************************************************
  The OpenID Connect (OIDC) Relying Party (RP) session cookie,
  OIDCSESSIONID_(clientId), remains after logout.  This cookie
  should be deleted upon logout.
  

Problem conclusion

• The OIDC Relying Party is updated to support logout through
  the HttpServletRequest.logout() Java API call. This API call
  will clear the LtpaToken2 and any other cookies the OIDC
  RP created.
  
  Note that logout through the deprecated revokeSSOCookies()
  method and through the ibm_security_logout servlet is not
  supported for the OpenID Connect Relying Party.
  
  The fix for this APAR is currently targeted for inclusion in
  fix packs 8.0.0.13 and 8.5.5.10.  Please refer to
  the Recommended Updates page for delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  
  Keywords: IBMWL3WSS, OIDC
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels

• R800 PSY

     UP

• R850 PSY

     UP