JanssenProject / JanssenProject/jans

Dynamic client registration cannot be disabled via config API nor terraform, and related configuration appears to be missing

Open
#13,693 0 comments 0 reactions 1 assignee Claimed by @moabu View on GitHub
Dominant language
Java
Stars
647
Forks
173
Avg merge
1d 18h
Merged PRs (30d)
110

Description

**Describe the bug**
It does not seem possible to turn off dynamic client registration.

According to the documentation, dynamicRegistrationEnabled can be set to false using a patch request to the auth server config endpoint. However, even after applying the patch successfully, it is still possible to insert/register clients.

**To Reproduce**
Send the following request:

```
curl -X PATCH -k -H 'Content-Type: application/json-patch+json' \
-i 'https://config-api-host-name/jans-config-api/api/v1/jans-auth-server/config' \
-H "Authorization: Bearer " --data-raw '[
{
"op": "add",
"path": "/dynamicRegistrationEnabled",
"value": "false"
}
]'
```

Then attempt to register or insert a client via the register endpoint in auth-server.
```
https://jans-auth-host-name/restv1/register
```

**Expected behavior**
When dynamicRegistrationEnabled is set to false, dynamic client registration should be disabled and it should no longer be possible to register/insert clients.

**Actual behavior**
Even after setting dynamicRegistrationEnabled to false, client insertion/registration is still possible.

**Additional findings**
There also seem to be related configuration gaps:
- There is missing configuration for this in the Janssen Terraform provider.
- There is no corresponding field in the JSON blob stored in the jansConfDyn column of the jansAppConf table.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.