OAuth2AuthorizationCodeRequestAuthenticationConverter can not handle multi-valued parameters

[martin-lindstrom]

According to section 2.1 of RFC 8707 - Resource Indicators for OAuth 2.0 multiple resource values should be sent as the example below:

  GET /as/authorization.oauth2?response_type=code
     &client_id=s6BhdRkqt3
     &state=tNwzQ87pC6llebpmac_IDeeq-mCR2wLDYljHUZUAWuI
     &redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb
     &scope=calendar%20contacts
     &resource=https%3A%2F%2Fcal.example.com%2F
     &resource=https%3A%2F%2Fcontacts.example.com%2F HTTP/1.1
  Host: authorization-server.example.com

The OAuth2AuthorizationCodeRequestAuthenticationConverter.convert method only handles single value parameters:

Map<String, Object> additionalParameters = new HashMap<>();
parameters.forEach((key, value) -> {
  if (!key.equals(OAuth2ParameterNames.RESPONSE_TYPE) &&
      !key.equals(OAuth2ParameterNames.CLIENT_ID) &&
      !key.equals(OAuth2ParameterNames.REDIRECT_URI) &&
      !key.equals(OAuth2ParameterNames.SCOPE) &&
      !key.equals(OAuth2ParameterNames.STATE)) {
  additionalParameters.put(key, value.get(0));
}

This leads to that only the first resource parameter value is saved in the resulting OAuth2AuthorizationCodeRequestAuthenticationToken.

[jgrandja]

@martin-lindstrom Resource Indicators for OAuth 2.0 has not been implemented yet. We're already tracking it via gh-279 but it's lower priority at the moment since there is minimal upvotes so far.

Closing this as a duplicate of gh-279.

[martin-lindstrom]

It really isn't about whether you support RFC8707 or not. It is a bug in OAuth2AuthorizationCodeRequestAuthenticationConverter.convert that only saves the first value of multi-valued parameters, independently of which unknown parameter that is being processed. OK, if you don't implement RFC8707 anytime soon, but IMHO the bug should be fixed.

[jgrandja]

@martin-lindstrom Fair point.

Would you be interested in submitting a PR with the fix?

[martin-lindstrom]

@martin-lindstrom Fair point.

Would you be interested in submitting a PR with the fix?

Thanks! Will do!