fix: OIDC client registration scope handling auth enforcement (#51311) - #51635

testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/OIDCClientRegistrationTest.java:249

• ClientsResource.get expects the client's internal UUID, not its client_id; once this test creates the intended ID mismatch, this lookup returns a missing resource instead of verifying the update. Resolve the resource by client ID first.

        ClientResource clientResource = adminClient.realm(REALM_NAME).clients().get("test-client-with-explicit-id");

services/src/main/java/org/keycloak/services/clientregistration/AbstractClientRegistrationProvider.java:216

• Restoring defaults after updateClientScopes cannot move a requested scope back from optional to default: addClientScope ignores a scope name that is already assigned (see model/jpa/.../JpaRealmProvider.java:1376-1380). An update with scope: "profile phone" therefore demotes the existing default profile scope; populate the representation's defaults before reconciliation instead.

        // Restore the previously-existing default scopes that were not overridden by the request.
        if (!existingDefaultScopes.isEmpty()) {
            for (Map.Entry<String, ClientScopeModel> entry : existingDefaultScopes.entrySet()) {
                if (rep.getDefaultClientScopes() == null || !rep.getDefaultClientScopes().contains(entry.getKey())) {
                    client.addClientScope(entry.getValue(), true);

services/src/main/java/org/keycloak/services/clientregistration/AbstractClientRegistrationProvider.java:203

• This condition also changes the default client-registration endpoint: a ClientRepresentation update that supplies optionalClientScopes but omits defaultClientScopes previously removed/demoted the omitted defaults via RepresentationToModel.updateClientScopes, but now silently preserves them. Restrict this preservation to the OIDC registration path so this security fix does not introduce a breaking semantic change for the default endpoint.

        if (rep.getDefaultClientScopes() == null && rep.getOptionalClientScopes() != null) {

services/src/main/java/org/keycloak/services/clientregistration/oidc/OIDCClientRegistrationProvider.java:141

• update() has already reconciled scopes at AbstractClientRegistrationProvider.java:197 and returns a representation whose default-scope list is always non-null (ModelToRepresentation.java:914). Consequently this post-update block never restores anything, and supplying scope removes all existing default client scopes; preserve them after requireUpdate() but before updateClientScopes() runs.

            client = update(clientId, oidcContext);

testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/OIDCClientRegistrationTest.java:232

• The OIDC registration POST rejects every non-null client_id (OIDCClientRegistrationProvider.java:90-92), so this setup returns 400 and never exercises the update path. Create the explicit-ID client through the admin API, then authenticate the OIDC update with a regenerated registration access token.

        OIDCClientRepresentation client = createRep();
        client.setClientId("test-client-with-explicit-id");
        OIDCClientRepresentation response = reg.oidc().create(client);
        reg.auth(Auth.token(response));

testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/OIDCClientRegistrationTest.java:256

• This only verifies the requested optional scopes, so the test passes even though the updated implementation removes every existing default scope. Also assert that the realm's default OIDC scopes remain attached to cover the preservation behavior described by the production code.

        assertTrue(CollectionUtil.collectionEquals(Arrays.asList("phone", "address"), rep.getOptionalClientScopes()));

services/src/main/java/org/keycloak/services/clientregistration/oidc/OIDCClientRegistrationProvider.java:149

• This scope lookup still runs before update() (line 158), while auth.requireUpdate() is only called inside AbstractClientRegistrationProvider.update(). An unauthenticated request for a nonexistent client therefore returns this 404 instead of the intended 401, so the new ordering regression test will fail; preserve the scopes only after the update authorization boundary (likely by separating authorization from mutation).

            if (clientOIDC.getScope() != null) {
                ClientModel oldClient = session.getContext().getRealm().getClientByClientId(clientOIDC.getClientId());
                if (oldClient == null) {
                    throw new ErrorResponseException(ErrorCodes.INVALID_CLIENT_METADATA, "Client not found: " + clientOIDC.getClientId(), Response.Status.NOT_FOUND);

testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/client/OIDCClientRegistrationTest.java:244

• The admin create endpoint returns an empty 201 Created response with the new UUID only in the Location header (services/.../ClientsResource.java:201-203), so readEntity(ClientRepresentation.class) fails and this regression test never reaches the update. Resolve the created client through the existing admin helper instead.

        ClientRepresentation created = createResponse.readEntity(ClientRepresentation.class);

services/src/main/java/org/keycloak/services/clientregistration/oidc/OIDCClientRegistrationProvider.java:149

• This scope lookup still runs before update(clientId, oidcContext), while auth.requireUpdate(...) is only called inside that method (AbstractClientRegistrationProvider.java:175). Consequently, the new unauthenticated test receives this 404 instead of the expected 401, and client lookup still occurs before authentication; move the preservation logic to an authenticated pre-reconciliation point and use the path clientId for that lookup.

            if (clientOIDC.getScope() != null) {
                ClientModel oldClient = session.getContext().getRealm().getClientByClientId(clientOIDC.getClientId());
                if (oldClient == null) {
                    throw new ErrorResponseException(ErrorCodes.INVALID_CLIENT_METADATA, "Client not found: " + clientOIDC.getClientId(), Response.Status.NOT_FOUND);