Use case-insensitive DPoP scheme check

[sberyozkin]

Fixes #48085

We already have an integration test with the DPoP value, so I just moved the check to OidcUtils to test a few more variations

[Copilot]

Pull Request Overview

Enables case-insensitive handling of the DPoP authorization scheme and centralizes the logic in OidcUtils.

• Introduce isDPoPScheme in OidcUtils for case-insensitive comparisons
• Update BearerAuthenticationMechanism to use the new utility method
• Add unit tests covering uppercase and lowercase scheme values

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
OidcUtils.java	Added isDPoPScheme to perform a case-insensitive check against DPOP_SCHEME
BearerAuthenticationMechanism.java	Updated the DPoP check to use OidcUtils.isDPoPScheme
OidcUtilsTest.java	Added testDpopScheme to verify behavior with different casing

Comments suppressed due to low confidence (2)

extensions/oidc/runtime/src/test/java/io/quarkus/oidc/runtime/OidcUtilsTest.java:37

• [nitpick] Consider renaming this test to testIsDPoPScheme to clearly reflect the method under test and align with naming conventions.

public void testDpopScheme() throws Exception {

extensions/oidc/runtime/src/test/java/io/quarkus/oidc/runtime/OidcUtilsTest.java:40

• Add an assertion for a mixed-case input (e.g., "dPoP") to ensure full coverage of case-insensitivity.

assertTrue(OidcUtils.isDPoPScheme("dpop"));

[Copilot]

[nitpick] Add a brief Javadoc comment explaining the purpose of this method, its parameters, and that it performs a case-insensitive comparison.

Suggested change

	/**
	* Checks if the provided authorization scheme matches the DPoP (Demonstration of Proof-of-Possession) scheme.
	*
	* @param authorizationScheme the authorization scheme to check; may be null
	* @return {@code true} if the authorization scheme matches the DPoP scheme (case-insensitive), {@code false} otherwise
	*/

[gsmet]

Let's not clutter our code with useless javadoc for very simple methods, thanks!

[sberyozkin]

@gsmet Sounds good, as I was about to ask for feedback on this one, as I was hesitating a bit :-).

[gsmet]

@sberyozkin I think it should go in 3.20 too, right? AFAICS, DPoP was introduced in 3.19. I added the label. Shout loudly if it was a mistake :)

[sberyozkin]

Thanks @gsmet, indeed, should also be backported to 3.20

[quarkus-bot]

Status for workflow Quarkus CI

This is the status report for running Quarkus CI on commit d1456b1.

✅ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

You can consult the Develocity build scans.