SSL Certificate Parsing Failure in SCIM OAuth2 Integration After Upgrading to Identity Security Platform 4.0.2

Products

• Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)

Issue/Introduction

After upgrading to Identity Security Platform 4.0.2, administrators may observe an SSL certificate parsing failure in the ssp-admin container when the SCIM provider is configured to use OAuth2 with a custom SSL certificate alias. The service fails to create the SSL context for the configured certificate and falls back to an accept-all SSL mode, which may not meet security compliance requirements. 

The following log entries appear in the ssp-admin container logs:

msg: "Creating RestTemplate with OAuth2 support using SCIM OAuth2 token SSL configuration"
msg: "Creating SSL context with certificate alias: <configured-alias>"
msg: "Failed to create SSL context with certificate alias: <configured-alias>"

java.security.cert.CertificateException: Could not parse certificate:
  java.io.IOException: Empty input
    at java.base/sun.security.provider.X509Factory.engineGenerateCertificate(X509Factory.java:103)
    at java.base/java.security.cert.CertificateFactory.generateCertificate(CertificateFactory.java:355)
    at com.broadcom.layer7authentication.core.service.provider.OAuth2RestTemplateIntegration
         .createSSLContextWithCertificate(OAuth2RestTemplateIntegration.java:550)
    at com.broadcom.layer7authentication.core.service.provider.OAuth2RestTemplateIntegration
         .createRestTemplateWithOAuth2Support(OAuth2RestTemplateIntegration.java:381)
    ...

msg: "Failed to load certificate with alias '<configured-alias>', falling back to accept-all SSL"

Environment

Product: Broadcom Identity Security Platform (IDSP)
Affected Version: 4.0.2

Resolution

This defect has been identified and fixed in Identity Security Platform version 4.0.3.

Recommended action: Upgrade to IDSP 4.0.3 to resolve the issue. After upgrading, the SSL context will correctly parse the configured certificate alias and establish a validated TLS connection for SCIM OAuth2 token communication.