Handle OAuth clients with same redirect URIs

``` master: #5981 ```
apereo · Feb 2, 2024 · a2ffeb7 · a2ffeb7
1 parent 303a871
commit a2ffeb7
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 2 deletions.
diff --git a/...rg/apereo/cas/support/oauth/web/endpoints/OAuth20CallbackAuthorizeEndpointController.java b/...rg/apereo/cas/support/oauth/web/endpoints/OAuth20CallbackAuthorizeEndpointController.java
@@ -52,8 +52,7 @@ public ModelAndView handleRequest(final HttpServletRequest request, final HttpSe
         if (clientId.isPresent() && redirectUri.isPresent()) {
             val servicesManager = getConfigurationContext().getServicesManager();
             val serviceClient = OAuth20Utils.getRegisteredOAuthServiceByClientId(servicesManager, clientId.get());
-            val serviceRedirectUri = OAuth20Utils.getRegisteredOAuthServiceByRedirectUri(servicesManager, redirectUri.get());
-            if (serviceClient != null && serviceClient.equals(serviceRedirectUri)) {
+            if (serviceClient != null && serviceClient.matches(redirectUri.get())) {
                 defaultUrl = redirectUri.get();
             }
         }

diff --git a/...ereo/cas/support/oauth/web/endpoints/OAuth20CallbackAuthorizeEndpointControllerTests.java b/...ereo/cas/support/oauth/web/endpoints/OAuth20CallbackAuthorizeEndpointControllerTests.java
@@ -48,6 +48,21 @@ void verifyOperation() throws Throwable {
         assertEquals(REDIRECT_URI, ((AbstractUrlBasedView) view.getView()).getUrl());
     }
 
+    @Test
+    void verifyOperationClientsWithSameRedirectUri() throws Throwable {
+        addRegisteredService();
+        val newRegisteredService = addRegisteredService();
+        addRegisteredService();
+
+        val request = new MockHttpServletRequest();
+        request.addParameter(OAuth20Constants.CLIENT_ID, newRegisteredService.getClientId());
+        request.addParameter(OAuth20Constants.REDIRECT_URI, REDIRECT_URI);
+        val response = new MockHttpServletResponse();
+        val view = callbackAuthorizeController.handleRequest(request, response);
+        assertNotNull(view);
+        assertEquals(REDIRECT_URI, ((AbstractUrlBasedView) view.getView()).getUrl());
+    }
+
     @Test
     void verifyOperationWithoutRedirectUri() throws Throwable {
         val request = new MockHttpServletRequest();