[OID4VP] Introduce SD-JWT User Attribute / Session mappers - #51632

services/src/main/java/org/keycloak/broker/oid4vp/mappers/ClaimPath.java:77

• The trailing-dot guard rejects an escaped terminal dot such as org\., despite the documented literal-dot syntax, while splitClaimPath treats leading or consecutive unescaped separators (.a, a..b) as field text instead of malformed components. Validate separators by backslash parity so only unescaped empty path components are rejected.

        // The splitting below would silently drop a trailing separator, so a path ending in a
        // dot is always malformed, even an escaped one.
        if (path == null || path.endsWith(".")) {
            return null;

services/src/main/java/org/keycloak/broker/oid4vp/mappers/ClaimPath.java:76

• This rejects an escaped terminal dot as well as a separator, so a JSON claim whose literal name ends in . cannot be addressed despite the documented \. escaping syntax. Detect only an unescaped terminal separator (accounting for odd/even preceding backslashes) and keep escaped terminal dots as field content.

        // The splitting below would silently drop a trailing separator, so a path ending in a
        // dot is always malformed, even an escaped one.
        if (path == null || path.endsWith(".")) {

services/src/main/java/org/keycloak/broker/oid4vp/mappers/OID4VPSdJwtUserAttributeMapper.java:105

• Blank scalar claims are applied to the broker context here, while updateBrokeredUser deliberately ignores them via setIfPresent. In particular, mapping a blank claim to username sets a non-null empty model username, preventing the broker's normal username fallback and causing first-login user creation to fail; use the same non-blank guard on this path.

            case USERNAME -> context.setModelUsername(values.get(0));
            case EMAIL -> context.setEmail(values.get(0));
            case FIRST_NAME -> context.setFirstName(values.get(0));
            case LAST_NAME -> context.setLastName(values.get(0));

services/src/main/java/org/keycloak/broker/oid4vp/mappers/ClaimPath.java:80

• JsonUtils.splitClaimPath does not reject empty components: .email is parsed as the field .email, and address..locality as address followed by .locality. These malformed paths can therefore select matching JSON keys instead of returning null as this parser promises; validate leading and consecutive unescaped separators before constructing steps.

        for (String segment : JsonUtils.splitClaimPath(path)) {