Fix NullPointerException bugs in JWT Authorization Grant validators

[Copilot]

Description

Code review of the ID-JAG JWT Authorization Grant implementation revealed 5 critical NPE bugs in validator initialization and claim access patterns.

Issues Fixed

IDJWTAuthorizationGrantValidator.java

• getOtherClaims() accessed without null check → NPE when claims map missing
• client_id claim accessed without null check → NPE when claim absent
• Improved error messages to distinguish missing claims map vs missing claim

JWTAuthorizationGrantType.java

• getIssuer() and getSubject() called before clientAssertionState initialization when using custom validators:

  // Bug: These methods dereference null clientAssertionState
  event.detail(Details.IDENTITY_PROVIDER_ISSUER, authorizationGrantContext.getIssuer());
  event.detail(Details.IDENTITY_PROVIDER_USER_ID, authorizationGrantContext.getSubject());
  
  // Then initialization happens
  authorizationGrantContext.setClientAssertionState(clientAssertionState);

  Moved event detail calls after state initialization.

• Expiration comparison with nullable Long values → NPE:

  // Bug: getExp() returns Long, can be null
  if (authorizationGrantContext.getJWT().getExp() < responseBuilder.getAccessToken().getExp())
  
  // Fixed
  Long jwtExp = authorizationGrantContext.getJWT().getExp();
  Long accessTokenExp = responseBuilder.getAccessToken().getExp();
  if (jwtExp != null && accessTokenExp != null && jwtExp < accessTokenExp)

Impact

Prevents NPEs in:

• ID-JAG tokens missing client_id in OtherClaims
• Custom validator initialization flow
• Tokens without expiration claims

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• repo.gradle.org
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java -classpath /home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91/boot/plexus-classworlds-2.8.0.jar -Dclassworlds.conf=/home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91/bin/m2.conf -Dmaven.home=/home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91 -Dlibrary.jansi.path=/home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91/lib/jansi-native -Dmaven.multiModuleProjectDirectory=/home/REDACTED/work/keycloak/keycloak org.codehaus.plexus.classworlds.launcher.Launcher clean compile -pl services -am -DskipTests (dns block)
• repository.jboss.org
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java -classpath /home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91/boot/plexus-classworlds-2.8.0.jar -Dclassworlds.conf=/home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91/bin/m2.conf -Dmaven.home=/home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91 -Dlibrary.jansi.path=/home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91/lib/jansi-native -Dmaven.multiModuleProjectDirectory=/home/REDACTED/work/keycloak/keycloak org.codehaus.plexus.classworlds.launcher.Launcher clean compile -pl services -am -DskipTests (dns block)
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java -classpath /home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91/boot/plexus-classworlds-2.8.0.jar -Dclassworlds.conf=/home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91/bin/m2.conf -Dmaven.home=/home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91 -Dlibrary.jansi.path=/home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91/lib/jansi-native -Dmaven.multiModuleProjectDirectory=/home/REDACTED/work/keycloak/keycloak org.codehaus.plexus.classworlds.launcher.Launcher test -pl tests/base -Dtest=IDJWTAuthorizationGrantTest -am (dns block)
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java -classpath /home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91/boot/plexus-classworlds-2.8.0.jar -Dclassworlds.conf=/home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91/bin/m2.conf -Dmaven.home=/home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91 -Dlibrary.jansi.path=/home/REDACTED/.m2/wrapper/dists/apache-maven-3.9.8/af622e91/lib/jansi-native -Dmaven.multiModuleProjectDirectory=/home/REDACTED/work/keycloak/keycloak org.codehaus.plexus.classworlds.launcher.Launcher install -DskipTests -pl services -am (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[tnorimat]

@bucchi Hello, I asked github copilot coding agent to review the branch and suggest codes to fix potential bugs if exist. It is the trial of using the agent, so you need not to follow the code suggestion.