[java-idp-oidc] branch maint-4.3 updated: JOIDC-302 - Improve null/empty grant_types in dynamic client registration

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch maint-4.3
in repository java-idp-oidc.

View the commit online:
https://codeberg.org/Shibboleth/java-idp-oidc/commit/1557793304f255a7da91c23448affe32527e411f

The following commit(s) were added to refs/heads/maint-4.3 by this push:
     new 15577933 JOIDC-302 - Improve null/empty grant_types in dynamic client registration
15577933 is described below

commit 1557793304f255a7da91c23448affe32527e411f
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Nov 6 08:04:35 2026 +0200

    JOIDC-302 - Improve null/empty grant_types in dynamic client registration
    
    https://shibboleth.atlassian.net/browse/JOIDC-302
---
 .../profile/impl/AddGrantTypeToClientMetadata.java | 22 +++++++++++-----------
 .../impl/AddGrantTypeToClientMetadataTest.java     | 16 ++++++++++++----
 2 files changed, 23 insertions(+), 15 deletions(-)

diff --git a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddGrantTypeToClientMetadata.java b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddGrantTypeToClientMetadata.java
index 7f8d07cf..856a2b58 100644
--- a/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddGrantTypeToClientMetadata.java
+++ b/idp-oidc-extension-impl/src/main/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddGrantTypeToClientMetadata.java
@@ -139,12 +139,12 @@ public class AddGrantTypeToClientMetadata extends AbstractOIDCClientMetadataPopu
         final Set<GrantType> grantTypes = getInputMetadata().getGrantTypes();
         log.trace("{} Requested grant types: {}", getLogPrefix(), grantTypes);
         final Set<GrantType> resultTypes = new HashSet<>();
-        if (grantTypes == null || grantTypes.isEmpty()) {
-            log.debug("{} No requested grant types, adding the default set", getLogPrefix());
-            for (final GrantType grantType : supportedGrantTypes.keySet()) {
-                addGrantTypeIfEnabled(resultTypes, grantType, supportedGrantTypes.get(grantType), 
-                        profileRequestContext);
-            }
+        if (grantTypes == null) {
+            log.debug("{} No requested grant types, adding the default authorization_code", getLogPrefix());
+            addGrantTypeIfEnabled(resultTypes, GrantType.AUTHORIZATION_CODE,
+                    supportedGrantTypes.get(GrantType.AUTHORIZATION_CODE), profileRequestContext);
+        } else if (grantTypes.isEmpty()) {
+            log.warn("{} Requested grant types array is empty", getLogPrefix());
         } else {
             for (final GrantType grantType : grantTypes) {
                 if (supportedGrantTypes.keySet().contains(grantType)) {
@@ -154,11 +154,11 @@ public class AddGrantTypeToClientMetadata extends AbstractOIDCClientMetadataPopu
                     log.warn("{} Ignoring unsupported requested grant type {}", getLogPrefix(), grantType);
                 }
             }
-            if (resultTypes.isEmpty()) {
-                log.error("{} No supported grant types requested", getLogPrefix());
-                ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
-                return;
-            }
+        }
+        if (resultTypes.isEmpty()) {
+            log.warn("{} No supported grant types requested", getLogPrefix());
+            ActionSupport.buildEvent(profileRequestContext, EventIds.INVALID_MESSAGE);
+            return;
         }
         getOutputMetadata().setGrantTypes(resultTypes);
     }
diff --git a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddGrantTypeToClientMetadataTest.java b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddGrantTypeToClientMetadataTest.java
index 432078bb..20639a07 100644
--- a/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddGrantTypeToClientMetadataTest.java
+++ b/idp-oidc-extension-impl/src/test/java/net/shibboleth/idp/plugin/oidc/op/profile/impl/AddGrantTypeToClientMetadataTest.java
@@ -65,10 +65,18 @@ public class AddGrantTypeToClientMetadataTest extends BaseOIDCClientMetadataPopu
         Assert.assertNull(action.execute(requestCtx));
         final Set<GrantType> resultTypes = result.getGrantTypes();
         Assert.assertNotNull(resultTypes);
-        Assert.assertEquals(resultTypes.size(), 3);
-        Assert.assertTrue(resultTypes.contains(GrantType.AUTHORIZATION_CODE));
-        Assert.assertTrue(resultTypes.contains(GrantType.IMPLICIT));
-        Assert.assertTrue(resultTypes.contains(GrantType.REFRESH_TOKEN));
+        Assert.assertEquals(resultTypes, Set.of(GrantType.AUTHORIZATION_CODE));
+    }
+
+    @Test
+    public void testEmptyArray() throws ComponentInitializationException {
+        final OIDCClientMetadata request = new OIDCClientMetadata();
+        request.setGrantTypes(CollectionSupport.emptySet());
+        final OIDCClientMetadata result = new OIDCClientMetadata();
+        setUpContext(request, result);
+        final Event event = action.execute(requestCtx);
+        assert event != null;
+        Assert.assertEquals(event.toString(), EventIds.INVALID_MESSAGE);
     }
 
     @Test

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.