OIDC identity provider receives wrong client-id for client-id containing colon

[EmteZogaf]

OIDC identity provider (keycloak) rejects authentication and shows only substring of actual client-id in log message when BPE client connections configuration has client-id containing colon (:)

Description

Effected DSF Version

• ≥ 2.0.0

To Reproduce

Configuration:

• Set DSF BPE configuration variable DEV_DSF_BPE_FHIR_CLIENT_CONNECTIONS_CONFIG to

  fhir-store:
    base-url: "https://www.example.com/fhir"
    test-connection-on-startup: yes
    oidc-auth:
      base-url: "https://auth.example.com/realms/test"
      client-id: "foo:bar"
      client-secret: "password"

Steps to reproduce the behavior:

1. Configure keycloak with realm test and add client with client id foo:bar and password password
2. Start DSF BPE Server
3. Wait till connection test of client connection fhir-store fails in BPE logs
4. See keycloak logs

Expected Behavior

OIDC identity provider accepts client credentials and connection test in BPE succeeds

Logs

BPE:

[main] DEBUG dev.dsf.bpe.spring.config.FhirClientConnectionsConfig - Testing connection with OIDC provider at https://auth.example.com/realms/test for 'fhir-store' [Failed]
dev.dsf.bpe.api.client.oidc.OidcClientException: Unexpected response status code 401 Unauthorized

Keycloak:

WARN  [org.keycloak.events] (executor-thread-171) type="CLIENT_LOGIN_ERROR", realmId="test", realmName="test", clientId="foo", userId="null", ipAddress="172.18.0.1", error="client_not_found", grant_type="client_credentials"

Screenshots

[EmteZogaf]

As workaround you can set the url-encoded client-id in the configuration (foo:bar → foo%3Abar). This also applies to the corresponding client-id environment variable of the 1.x.y.z versions of the report, data-sharing and data-transfer plugins.

[EmteZogaf]

I wrote too soon, the aforementioned workaround does not work, because the issued access token contains the correct, url-decoded clientId as azp which does not match the client-side configured url-encoded clientId and therefor does not pass client-side verification.