JanssenProject / JanssenProject/jans
Dynamic client registration cannot be disabled via config API nor terraform, and related configuration appears to be missing
- Dominant language
- Java
- Stars
- 647
- Forks
- 173
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 110
Description
**Describe the bug**
It does not seem possible to turn off dynamic client registration.
According to the documentation, dynamicRegistrationEnabled can be set to false using a patch request to the auth server config endpoint. However, even after applying the patch successfully, it is still possible to insert/register clients.
**To Reproduce**
Send the following request:
```
curl -X PATCH -k -H 'Content-Type: application/json-patch+json' \
-i 'https://config-api-host-name/jans-config-api/api/v1/jans-auth-server/config' \
-H "Authorization: Bearer " --data-raw '[
{
"op": "add",
"path": "/dynamicRegistrationEnabled",
"value": "false"
}
]'
```
Then attempt to register or insert a client via the register endpoint in auth-server.
```
https://jans-auth-host-name/restv1/register
```
**Expected behavior**
When dynamicRegistrationEnabled is set to false, dynamic client registration should be disabled and it should no longer be possible to register/insert clients.
**Actual behavior**
Even after setting dynamicRegistrationEnabled to false, client insertion/registration is still possible.
**Additional findings**
There also seem to be related configuration gaps:
- There is missing configuration for this in the Janssen Terraform provider.
- There is no corresponding field in the JSON blob stored in the jansConfDyn column of the jansAppConf table.
Contributor guide
Assessment
This issue has not been assessed yet.