Skip to content

Improve error message for invalid client in org context #3169

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ThaminduR wants to merge 1 commit into
base: master
Choose a base branch
from
+32 −1
Open

Improve error message for invalid client in org context #3169

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion ...o2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/OAuth2Service.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -461,7 +461,13 @@ public OAuth2AccessTokenRespDTO issueAccessToken(OAuth2AccessTokenReqDTO tokenRe
OAuth2AccessTokenRespDTO tokenRespDTO = new OAuth2AccessTokenRespDTO();
tokenRespDTO.setError(true);
tokenRespDTO.setErrorCode(OAuth2ErrorCodes.INVALID_CLIENT);
tokenRespDTO.setErrorMsg("Invalid Client");
String errorMessage = "Invalid Client";
Comment on lines 463 to +464
Copy link
Copy Markdown
Contributor

@wso2-engineering wso2-engineering bot Apr 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Log Improvement Suggestion No: 1

Suggested change
tokenRespDTO.setErrorCode(OAuth2ErrorCodes.INVALID_CLIENT);
tokenRespDTO.setErrorMsg("Invalid Client");
String errorMessage = "Invalid Client";
tokenRespDTO.setErrorCode(OAuth2ErrorCodes.INVALID_CLIENT);
log.error("Invalid client detected. Error code: {}", OAuth2ErrorCodes.INVALID_CLIENT);
String errorMessage = "Invalid Client";

String appOrgId = PrivilegedCarbonContext.getThreadLocalCarbonContext()
.getApplicationResidentOrganizationId();
if (StringUtils.isNotEmpty(appOrgId)) {
errorMessage = "Application is not available in the organization.";
Comment on lines +467 to +468
Copy link
Copy Markdown
Contributor

@wso2-engineering wso2-engineering bot Apr 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Log Improvement Suggestion No: 2

Suggested change
if (StringUtils.isNotEmpty(appOrgId)) {
errorMessage = "Application is not available in the organization.";
if (StringUtils.isNotEmpty(appOrgId)) {
log.warn("Application not available in organization. OrgId: {}", appOrgId);
errorMessage = "Application is not available in the organization.";

}
tokenRespDTO.setErrorMsg(errorMessage);
return tokenRespDTO;
} catch (IdentityOAuth2ClientException e) {
if (log.isDebugEnabled()) {
Expand Down
25 changes: 25 additions & 0 deletions ...arbon.identity.oauth/src/test/java/org/wso2/carbon/identity/oauth2/OAuth2ServiceTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -599,6 +599,31 @@ public void testExceptionForIssueAccesstoken(Object exception, String errorMsg)
}
}

@Test
public void testIssueAccessTokenWithOrgContextReturnsOrgSpecificError() throws IdentityException {

try (MockedStatic<IdentityTenantUtil> identityTenantUtil = mockStatic(IdentityTenantUtil.class);
MockedStatic<AccessTokenIssuer> accessTokenIssuer = mockStatic(AccessTokenIssuer.class)) {
identityTenantUtil.when(() -> IdentityTenantUtil.getTenantId(anyString())).thenReturn(-1234);
identityTenantUtil.when(() -> IdentityTenantUtil.getTenantDomain(-1234)).thenReturn("carbon.super");
AccessTokenIssuer mockAccessTokenIssuer = mock(AccessTokenIssuer.class);
accessTokenIssuer.when(AccessTokenIssuer::getInstance).thenReturn(mockAccessTokenIssuer);
when(mockAccessTokenIssuer.issue(any(OAuth2AccessTokenReqDTO.class)))
.thenThrow(new InvalidOAuthClientException("application.not.found"));

PrivilegedCarbonContext.getThreadLocalCarbonContext()
.setApplicationResidentOrganizationId("some-org-id");
try {
OAuth2AccessTokenRespDTO respDTO = oAuth2Service.issueAccessToken(new OAuth2AccessTokenReqDTO());
assertEquals(respDTO.getErrorCode(), OAuth2ErrorCodes.INVALID_CLIENT);
assertEquals(respDTO.getErrorMsg(), "Application is not available in the organization.");
} finally {
PrivilegedCarbonContext.getThreadLocalCarbonContext()
.setApplicationResidentOrganizationId(null);
}
}
}

@Test
public void testIsPKCESupportEnabled() {

Expand Down
Loading