Use MultiMap set method instead of add for client assertion parameters

[Sopka]

The issue is in OidcClientImpl.java, where add() is used instead of set() for JWT bearer authentication parameters. Other authentication methods correctly use set().

This causes a mismatch between the expected behavior (replacing previous values) and the actual behavior (accumulating values).

Replaced the add() method calls with set() in the JWT bearer authentication code path:

// Replace these lines:
body.add(OidcConstants.CLIENT_ASSERTION, clientAssertion);
body.add(OidcConstants.CLIENT_ASSERTION_TYPE, OidcConstants.JWT_BEARER_CLIENT_ASSERTION_TYPE);

// With:
body.set(OidcConstants.CLIENT_ASSERTION, clientAssertion);
body.set(OidcConstants.CLIENT_ASSERTION_TYPE, OidcConstants.JWT_BEARER_CLIENT_ASSERTION_TYPE);

This would ensure only the newest key-value pairs are included in the request, eliminating the duplication problem.

• Fixes: JWT Bearer Auth Form Parameters Accumulate with Each Request in OidcClientImpl #48879

[geoand]

Thanks a lot for the contribution!

Is there any chance we could have a test for this?

[sberyozkin]

Thanks @Sopka, @geoand. Indeed, would be good to have a test.

The test which sends a single request is here.
The wiremock stub is here.

I guess the simplest option is to do 2 calls in that test and tune the stub definition to fail if more than one client_assertion parameter is used. Or may be you can just update https://github.com/quarkusio/quarkus/blob/main/integration-tests/oidc-client-wiremock/src/main/java/io/quarkus/it/keycloak/OidcRequestCustomizer.java to check if the body contains only one of those parameters.

Have a look please, I can help if you'd like

[Sopka]

Added a test that makes multiple requests to the OIDC token endpoint using a filter configuration that always forces new token requests. This approach avoids issues with simulating token expiration and eliminates the need to wait for tokens to expire. The test verifies that each request sends the expected form parameters.

[quarkus-bot]

Status for workflow Quarkus CI

This is the status report for running Quarkus CI on commit dce6637.

✅ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

You can consult the Develocity build scans.

[sberyozkin]

Thanks @Sopka.

I think we can probably keep both commits, without squashing, as each of them is quite self-contained.
@geoand I'll merge soon if there are no objections, I can easily squash if preferred

[geoand]

Go ahead and merge as is