diff --git a/services/src/main/java/org/keycloak/protocol/oidc/par/endpoints/ParEndpoint.java b/services/src/main/java/org/keycloak/protocol/oidc/par/endpoints/ParEndpoint.java index 6ba4d19bfe7..b5ae1ab47a9 100644 --- a/services/src/main/java/org/keycloak/protocol/oidc/par/endpoints/ParEndpoint.java +++ b/services/src/main/java/org/keycloak/protocol/oidc/par/endpoints/ParEndpoint.java @@ -27,6 +27,7 @@ import org.keycloak.events.EventType; import org.keycloak.headers.SecurityHeadersProvider; import org.keycloak.models.KeycloakSession; import org.keycloak.models.SingleUseObjectProvider; +import org.keycloak.protocol.oidc.OIDCLoginProtocol; import org.keycloak.protocol.oidc.OIDCLoginProtocolService; import org.keycloak.protocol.oidc.endpoints.AuthorizationEndpointChecker; import org.keycloak.protocol.oidc.endpoints.request.AuthorizationEndpointRequest; @@ -108,6 +109,9 @@ public class ParEndpoint extends AbstractParEndpoint { try { authorizationRequest = ParEndpointRequestParserProcessor.parseRequest(event, session, client, decodedFormParameters); } catch (Exception e) { + if (!decodedFormParameters.containsKey(OIDCLoginProtocol.REQUEST_PARAM)) { + throw throwErrorResponseException(OAuthErrorException.INVALID_REQUEST, e.getMessage(), Response.Status.BAD_REQUEST); + } throw throwErrorResponseException(OAuthErrorException.INVALID_REQUEST_OBJECT, e.getMessage(), Response.Status.BAD_REQUEST); } diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/FAPI2DPoPTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/FAPI2DPoPTest.java index 385b52590a4..fae68379693 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/FAPI2DPoPTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/FAPI2DPoPTest.java @@ -444,7 +444,7 @@ public class FAPI2DPoPTest extends AbstractFAPI2Test { .signedJwt(signedJwt) .send(); assertEquals(400, pResp.getStatusCode()); - assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, pResp.getError()); + assertEquals(OAuthErrorException.INVALID_REQUEST, pResp.getError()); // Set request object and correct responseType requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId); diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/FAPI2Test.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/FAPI2Test.java index 82f10667845..68cb1dbed91 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/FAPI2Test.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/FAPI2Test.java @@ -335,7 +335,7 @@ public class FAPI2Test extends AbstractFAPITest { String signedJwt = createSignedRequestToken(clientId, Algorithm.PS256); ParResponse pResp = oauth.pushedAuthorizationRequest().nonce("123456").signedJwt(signedJwt).send(); assertEquals(400, pResp.getStatusCode()); - assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, pResp.getError()); + assertEquals(OAuthErrorException.INVALID_REQUEST, pResp.getError()); // Set request object and correct responseType requestObject = createValidRequestObjectForSecureRequestObjectExecutor(clientId); diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/par/ParTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/par/ParTest.java index e682e703896..3e4c7337c74 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/par/ParTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/par/ParTest.java @@ -1010,7 +1010,7 @@ public class ParTest extends AbstractClientPoliciesTest { oauth.redirectUri(CLIENT_REDIRECT_URI); ParResponse pResp = oauth.doPushedAuthorizationRequest(); assertEquals(400, pResp.getStatusCode()); - assertEquals(OAuthErrorException.INVALID_REQUEST_OBJECT, pResp.getError()); + assertEquals(OAuthErrorException.INVALID_REQUEST, pResp.getError()); } // PAR including invalid redirect_uri