Merge branch 'master' of https://github.com/wso2-extensions/identity-…

…inbound-auth-oauth into external-host
wso2-extensions · Dec 30, 2023 · d132be0 · d132be0
2 parents b30b60f + 24b8915
commit d132be0
Show file tree

Hide file tree

Showing 46 changed files with 319 additions and 74 deletions.
diff --git a/components/org.wso2.carbon.identity.api.server.dcr/pom.xml b/components/org.wso2.carbon.identity.api.server.dcr/pom.xml
@@ -5,12 +5,12 @@
     <parent>
         <groupId>org.wso2.carbon.identity.inbound.auth.oauth2</groupId>
         <artifactId>identity-inbound-auth-oauth</artifactId>
-        <version>6.11.224-SNAPSHOT</version>
+        <version>6.11.233-SNAPSHOT</version>
         <relativePath>../..</relativePath>
     </parent>
 
     <artifactId>org.wso2.carbon.identity.api.server.dcr</artifactId>
-    <version>6.11.224-SNAPSHOT</version>
+    <version>6.11.233-SNAPSHOT</version>
     <name>WSO2 Carbon -  User DCR Rest API</name>
     <description>WSO2 Carbon - User DCR Rest API</description>
 

diff --git a/components/org.wso2.carbon.identity.api.server.oauth.scope/pom.xml b/components/org.wso2.carbon.identity.api.server.oauth.scope/pom.xml
@@ -5,12 +5,12 @@
     <parent>
         <groupId>org.wso2.carbon.identity.inbound.auth.oauth2</groupId>
         <artifactId>identity-inbound-auth-oauth</artifactId>
-        <version>6.11.224-SNAPSHOT</version>
+        <version>6.11.233-SNAPSHOT</version>
         <relativePath>../..</relativePath>
     </parent>
 
     <artifactId>org.wso2.carbon.identity.api.server.oauth.scope</artifactId>
-    <version>6.11.224-SNAPSHOT</version>
+    <version>6.11.233-SNAPSHOT</version>
 
     <name>WSO2 Carbon - Identity OAuth 2.0 Scope Rest APIs</name>
     <description>Rest APIs for OAuth 2.0 Scope Handling</description>

diff --git a/components/org.wso2.carbon.identity.client.attestation.filter/pom.xml b/components/org.wso2.carbon.identity.client.attestation.filter/pom.xml
@@ -22,7 +22,7 @@
     <parent>
         <groupId>org.wso2.carbon.identity.inbound.auth.oauth2</groupId>
         <artifactId>identity-inbound-auth-oauth</artifactId>
-        <version>6.11.224-SNAPSHOT</version>
+        <version>6.11.233-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 

diff --git a/components/org.wso2.carbon.identity.discovery/pom.xml b/components/org.wso2.carbon.identity.discovery/pom.xml
@@ -21,7 +21,7 @@
         <groupId>org.wso2.carbon.identity.inbound.auth.oauth2</groupId>
         <artifactId>identity-inbound-auth-oauth</artifactId>
         <relativePath>../../pom.xml</relativePath>
-        <version>6.11.224-SNAPSHOT</version>
+        <version>6.11.233-SNAPSHOT</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

diff --git a/components/org.wso2.carbon.identity.oauth.ciba/pom.xml b/components/org.wso2.carbon.identity.oauth.ciba/pom.xml
@@ -20,7 +20,7 @@
     <parent>
         <artifactId>identity-inbound-auth-oauth</artifactId>
         <groupId>org.wso2.carbon.identity.inbound.auth.oauth2</groupId>
-        <version>6.11.224-SNAPSHOT</version>
+        <version>6.11.233-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 

diff --git a/components/org.wso2.carbon.identity.oauth.client.authn.filter/pom.xml b/components/org.wso2.carbon.identity.oauth.client.authn.filter/pom.xml
@@ -22,7 +22,7 @@
         <groupId>org.wso2.carbon.identity.inbound.auth.oauth2</groupId>
         <artifactId>identity-inbound-auth-oauth</artifactId>
         <relativePath>../../pom.xml</relativePath>
-        <version>6.11.224-SNAPSHOT</version>
+        <version>6.11.233-SNAPSHOT</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

diff --git a/components/org.wso2.carbon.identity.oauth.common/pom.xml b/components/org.wso2.carbon.identity.oauth.common/pom.xml
@@ -23,7 +23,7 @@
         <groupId>org.wso2.carbon.identity.inbound.auth.oauth2</groupId>
         <artifactId>identity-inbound-auth-oauth</artifactId>
         <relativePath>../../pom.xml</relativePath>
-        <version>6.11.224-SNAPSHOT</version>
+        <version>6.11.233-SNAPSHOT</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

diff --git a/...tity.oauth.common/src/main/java/org/wso2/carbon/identity/oauth/common/OAuthConstants.java b/...tity.oauth.common/src/main/java/org/wso2/carbon/identity/oauth/common/OAuthConstants.java
@@ -262,6 +262,7 @@ public static SubjectType fromValue(String text) {
     public static final String REQUEST_OBJECT_ENCRYPTION_METHOD = "OAuth.OpenIDConnect." +
             "SupportedRequestObjectEncryptionMethods.SupportedRequestObjectEncryptionMethod";
     public static final String IS_PUSH_AUTHORIZATION_REQUEST = "isPushAuthorizationRequest";
+    public static final String ALLOWED_SCOPES_PROPERTY = "allowedScopes";
 
 
     public static final String IS_THIRD_PARTY_APP = "isThirdPartyApp";

diff --git a/components/org.wso2.carbon.identity.oauth.dcr.endpoint/pom.xml b/components/org.wso2.carbon.identity.oauth.dcr.endpoint/pom.xml
@@ -6,7 +6,7 @@
         <groupId>org.wso2.carbon.identity.inbound.auth.oauth2</groupId>
         <artifactId>identity-inbound-auth-oauth</artifactId>
         <relativePath>../../pom.xml</relativePath>
-        <version>6.11.224-SNAPSHOT</version>
+        <version>6.11.233-SNAPSHOT</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

diff --git a/components/org.wso2.carbon.identity.oauth.dcr/pom.xml b/components/org.wso2.carbon.identity.oauth.dcr/pom.xml
@@ -22,7 +22,7 @@
         <groupId>org.wso2.carbon.identity.inbound.auth.oauth2</groupId>
         <artifactId>identity-inbound-auth-oauth</artifactId>
         <relativePath>../../pom.xml</relativePath>
-        <version>6.11.224-SNAPSHOT</version>
+        <version>6.11.233-SNAPSHOT</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

diff --git a/...ntity.oauth.dcr/src/main/java/org/wso2/carbon/identity/oauth/dcr/service/DCRMService.java b/...ntity.oauth.dcr/src/main/java/org/wso2/carbon/identity/oauth/dcr/service/DCRMService.java
@@ -643,6 +643,8 @@ private OAuthConsumerAppDTO createOAuthApp(ApplicationRegistrationRequest regist
                 oAuthConsumerApp.setTokenBindingType(OAuth2Constants.TokenBinderType.CERTIFICATE_BASED_TOKEN_BINDER);
                 oAuthConsumerApp.setTokenBindingValidationEnabled(true);
             }
+        } else {
+            oAuthConsumerApp.setTokenBindingType(OAuthConstants.OIDCConfigProperties.TOKEN_BINDING_TYPE_NONE);
         }
         oAuthConsumerApp.setPkceMandatory(registrationRequest.isExtPkceMandatory());
         oAuthConsumerApp.setPkceSupportPlain(registrationRequest.isExtPkceSupportPlain());

diff --git a/components/org.wso2.carbon.identity.oauth.endpoint/pom.xml b/components/org.wso2.carbon.identity.oauth.endpoint/pom.xml
@@ -22,7 +22,7 @@
         <groupId>org.wso2.carbon.identity.inbound.auth.oauth2</groupId>
         <artifactId>identity-inbound-auth-oauth</artifactId>
         <relativePath>../../pom.xml</relativePath>
-        <version>6.11.224-SNAPSHOT</version>
+        <version>6.11.233-SNAPSHOT</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

diff --git a/...oint/src/main/java/org/wso2/carbon/identity/oauth/endpoint/authz/OAuth2AuthzEndpoint.java b/...oint/src/main/java/org/wso2/carbon/identity/oauth/endpoint/authz/OAuth2AuthzEndpoint.java
@@ -212,6 +212,7 @@
 import static org.wso2.carbon.identity.oauth.endpoint.util.EndpointUtil.getSSOConsentService;
 import static org.wso2.carbon.identity.oauth.endpoint.util.EndpointUtil.retrieveStateForErrorURL;
 import static org.wso2.carbon.identity.oauth.endpoint.util.EndpointUtil.validateParams;
+import static org.wso2.carbon.identity.oauth2.OAuth2Constants.TokenBinderType.CLIENT_REQUEST;
 import static org.wso2.carbon.identity.oauth2.util.OAuth2Util.ACCESS_TOKEN_JS_OBJECT;
 import static org.wso2.carbon.identity.oauth2.util.OAuth2Util.DYNAMIC_TOKEN_DATA_FUNCTION;
 import static org.wso2.carbon.identity.openidconnect.model.Constants.AUTH_TIME;
@@ -1732,17 +1733,19 @@ private OAuthResponse handleSuccessAuthorization(OAuthMessage oAuthMessage, OIDC
             String tokenBindingValue = null;
             if (tokenBinderOptional.isPresent()) {
                 TokenBinder tokenBinder = tokenBinderOptional.get();
-                tokenBindingValue = tokenBinder.getOrGenerateTokenBindingValue(oAuthMessage.getRequest());
-                tokenBinder.setTokenBindingValueForResponse(oAuthMessage.getResponse(), tokenBindingValue);
-                if (LoggerUtils.isDiagnosticLogsEnabled()) {
-                    LoggerUtils.triggerDiagnosticLogEvent(new DiagnosticLog.DiagnosticLogBuilder(
-                            OAuthConstants.LogConstants.OAUTH_INBOUND_SERVICE, "generate-token-binding-value")
-                            .inputParam(LogConstants.InputKeys.CLIENT_ID, oauth2Params.getClientId())
-                            .inputParam("token binding value", tokenBindingValue)
-                            .configParam("token binder type", tokenBinder.getBindingType())
-                            .resultMessage("Successfully generated token binding value.")
-                            .logDetailLevel(DiagnosticLog.LogDetailLevel.APPLICATION)
-                            .resultStatus(DiagnosticLog.ResultStatus.SUCCESS));
+                if (!tokenBinder.getBindingType().equals(CLIENT_REQUEST)) {
+                    tokenBindingValue = tokenBinder.getOrGenerateTokenBindingValue(oAuthMessage.getRequest());
+                    tokenBinder.setTokenBindingValueForResponse(oAuthMessage.getResponse(), tokenBindingValue);
+                    if (LoggerUtils.isDiagnosticLogsEnabled()) {
+                        LoggerUtils.triggerDiagnosticLogEvent(new DiagnosticLog.DiagnosticLogBuilder(
+                                OAuthConstants.LogConstants.OAUTH_INBOUND_SERVICE, "generate-token-binding-value")
+                                .inputParam(LogConstants.InputKeys.CLIENT_ID, oauth2Params.getClientId())
+                                .inputParam("token binding value", tokenBindingValue)
+                                .configParam("token binder type", tokenBinder.getBindingType())
+                                .resultMessage("Successfully generated token binding value.")
+                                .logDetailLevel(DiagnosticLog.LogDetailLevel.APPLICATION)
+                                .resultStatus(DiagnosticLog.ResultStatus.SUCCESS));
+                    }
                 }
             }
             setAuthorizationCode(oAuthMessage, authzRespDTO, builder, tokenBindingValue, oauth2Params,
@@ -4434,6 +4437,16 @@ private Response handleApiBasedAuthenticationResponse(OAuthMessage oAuthMessage,
                 AuthServiceResponse authServiceResponse = (AuthServiceResponse) oAuthMessage.getRequest()
                         .getAttribute(AUTH_SERVICE_RESPONSE);
 
+                if (authServiceResponse.getFlowStatus() == AuthServiceConstants.FlowStatus.FAIL_COMPLETED) {
+                    if (authServiceResponse.getErrorInfo().isPresent()) {
+                        throw new AuthServiceClientException(authServiceResponse.getErrorInfo().get().getErrorCode(),
+                                authServiceResponse.getErrorInfo().get().getErrorDescription());
+                    } else {
+                        throw new AuthServiceClientException(
+                                AuthServiceConstants.ErrorMessage.ERROR_INVALID_AUTH_REQUEST.message());
+                    }
+                }
+
                 AuthResponse authResponse = API_AUTHN_HANDLER.handleResponse(authServiceResponse);
                 ObjectMapper objectMapper = new ObjectMapper();
                 objectMapper.setSerializationInclusion(JsonInclude.Include.NON_EMPTY);

diff --git a/...uth.endpoint/src/main/java/org/wso2/carbon/identity/oauth/endpoint/util/EndpointUtil.java b/...uth.endpoint/src/main/java/org/wso2/carbon/identity/oauth/endpoint/util/EndpointUtil.java
@@ -40,6 +40,7 @@
 import org.slf4j.MDC;
 import org.wso2.carbon.base.ServerConfiguration;
 import org.wso2.carbon.context.PrivilegedCarbonContext;
+import org.wso2.carbon.identity.api.resource.mgt.APIResourceMgtException;
 import org.wso2.carbon.identity.application.authentication.framework.cache.AuthenticationRequestCacheEntry;
 import org.wso2.carbon.identity.application.authentication.framework.config.builder.FileBasedConfigurationBuilder;
 import org.wso2.carbon.identity.application.authentication.framework.exception.UserIdNotFoundException;
@@ -95,11 +96,13 @@
 import org.wso2.carbon.identity.oauth2.bean.OAuthClientAuthnContext;
 import org.wso2.carbon.identity.oauth2.bean.Scope;
 import org.wso2.carbon.identity.oauth2.dto.OAuth2ClientValidationResponseDTO;
+import org.wso2.carbon.identity.oauth2.internal.OAuth2ServiceComponentHolder;
 import org.wso2.carbon.identity.oauth2.model.CarbonOAuthAuthzRequest;
 import org.wso2.carbon.identity.oauth2.model.OAuth2Parameters;
 import org.wso2.carbon.identity.oauth2.model.OAuth2ScopeConsentResponse;
 import org.wso2.carbon.identity.oauth2.scopeservice.OAuth2Resource;
 import org.wso2.carbon.identity.oauth2.scopeservice.ScopeMetadataService;
+import org.wso2.carbon.identity.oauth2.util.AuthzUtil;
 import org.wso2.carbon.identity.oauth2.util.OAuth2Util;
 import org.wso2.carbon.identity.openidconnect.OIDCRequestObjectUtil;
 import org.wso2.carbon.identity.openidconnect.RequestObjectBuilder;
@@ -162,6 +165,7 @@ public class EndpointUtil {
     private static final String PROP_RESPONSE_TYPE = "response_type";
     private static final String PROP_SCOPE = "scope";
     private static final String PROP_OIDC_SCOPE = "requested_oidc_scopes";
+    private static final String PROP_CONSENT_SKIP_SCOPE = "consent_skip_scopes";
     private static final String PROP_ERROR = "error";
     private static final String PROP_ERROR_DESCRIPTION = "error_description";
     private static final String PROP_REDIRECT_URI = "redirect_uri";
@@ -948,19 +952,28 @@ private static String getConsentRequiredScopesAsString(Set<String> consentRequir
     private static String getQueryString(OAuth2Parameters params, SessionDataCacheEntry entry) throws
             UnsupportedEncodingException, OAuthSystemException {
 
-        String queryString;
-        queryString = entry.getQueryString();
-        if (queryString.contains(REQUEST_URI) && params != null) {
+        StringBuilder queryStringBuilder = new StringBuilder();
+        queryStringBuilder.append(entry.getQueryString());
+        if (entry.getQueryString().contains(REQUEST_URI) && params != null) {
             // When request_uri requests come without redirect_uri, we need to append it to the SPQueryParams
             // to be used in storing consent data
-            queryString = queryString +
-                    "&" + PROP_REDIRECT_URI + "=" + URLEncoder.encode(params.getRedirectURI(), UTF_8);
+            queryStringBuilder.append('&').append(PROP_REDIRECT_URI).append('=')
+                    .append(URLEncoder.encode(params.getRedirectURI(), UTF_8));
         }
 
         if (params != null) {
-            queryString = queryString + "&" + PROP_OIDC_SCOPE +
-                    "=" + URLEncoder.encode(StringUtils.join(getRequestedOIDCScopes(params), " "), UTF_8);
+            queryStringBuilder.append('&').append(PROP_OIDC_SCOPE).append('=')
+                    .append(URLEncoder.encode(StringUtils.join(getRequestedOIDCScopes(params), " "), UTF_8));
+        }
+        if (entry.getAuthzReqMsgCtx() != null) {
+            String[] filteredAllowedScopes = (String[]) entry.getAuthzReqMsgCtx()
+                    .getProperty(OAuthConstants.ALLOWED_SCOPES_PROPERTY);
+            if (ArrayUtils.isNotEmpty(filteredAllowedScopes)) {
+                queryStringBuilder.append('&').append(PROP_CONSENT_SKIP_SCOPE).append('=')
+                        .append(URLEncoder.encode(StringUtils.join(filteredAllowedScopes, " "), UTF_8));
+            }
         }
+        String queryString = queryStringBuilder.toString();
         entry.setQueryString(queryString);
         queryString = URLEncoder.encode(queryString, UTF_8);
         return queryString;
@@ -1272,7 +1285,7 @@ private static void startTenantFlow(String tenantDomain) {
     private static Set<String> dropUnregisteredScopes(OAuth2Parameters params) throws OAuthSystemException {
 
         Set<String> requestedScopes = new HashSet<>(params.getScopes());
-        Set<String> registeredScopes = getRegisteredScopes(requestedScopes);
+        Set<String> registeredScopes = getRegisteredScopes(requestedScopes, params.getTenantDomain());
         List<String> allowedScopesFromConfig = oauthServerConfiguration.getAllowedScopes();
         Set<String> filteredScopes = new HashSet<>();
 
@@ -1300,19 +1313,46 @@ private static Set<String> dropUnregisteredScopes(OAuth2Parameters params) throw
         return filteredScopes;
     }
 
-    private static Set<String> getRegisteredScopes(Set<String> requestedScopes) throws OAuthSystemException {
+    private static Set<String> getRegisteredScopes(Set<String> requestedScopes, String tenantDomain)
+            throws OAuthSystemException {
 
         try {
             String requestedScopesStr = StringUtils.join(requestedScopes, " ");
             Set<String> registeredScopes = new HashSet<>();
             Set<Scope> registeredScopeSet = oAuth2ScopeService.getScopes(null, null, true, requestedScopesStr);
             registeredScopeSet.forEach(scope -> registeredScopes.add(scope.getName()));
+            if (!AuthzUtil.isLegacyAuthzRuntime()) {
+                List<String> registeredAPIScopes = getRegisteredAPIScopes(requestedScopes, tenantDomain);
+                registeredScopes.addAll(registeredAPIScopes);
+            }
             return registeredScopes;
-        } catch (IdentityOAuth2ScopeServerException e) {
+        } catch (IdentityOAuth2ScopeServerException | IdentityOAuth2Exception e) {
             throw new OAuthSystemException("Error occurred while retrieving registered scopes.", e);
         }
     }
 
+    /**
+     * Get Scopes of registered API.
+     *
+     * @param tenantDomain Tenant domain.
+     * @return Registered scopes.
+     * @throws IdentityOAuth2Exception if an error occurs while retrieving internal scopes for tenant domain.
+     */
+    private static List<String> getRegisteredAPIScopes(Set<String> requestedScopes, String tenantDomain)
+            throws IdentityOAuth2Exception {
+
+        try {
+            List<org.wso2.carbon.identity.application.common.model.Scope> scopes = OAuth2ServiceComponentHolder
+                    .getInstance().getApiResourceManager().getScopesByTenantDomain(tenantDomain, null);
+            return scopes.stream().map(org.wso2.carbon.identity.application.common.model.Scope::getName)
+                    .filter(requestedScopes::contains)
+                    .collect(Collectors.toList());
+        } catch (APIResourceMgtException e) {
+            throw new IdentityOAuth2Exception("Error while retrieving internal scopes for tenant domain : "
+                    + tenantDomain, e);
+        }
+    }
+
     public static String getScope(OAuth2Parameters params) {
 
         StringBuilder scopes = new StringBuilder();

diff --git a/components/org.wso2.carbon.identity.oauth.extension/pom.xml b/components/org.wso2.carbon.identity.oauth.extension/pom.xml
@@ -19,7 +19,7 @@
     <parent>
         <artifactId>identity-inbound-auth-oauth</artifactId>
         <groupId>org.wso2.carbon.identity.inbound.auth.oauth2</groupId>
-        <version>6.11.224-SNAPSHOT</version>
+        <version>6.11.233-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <modelVersion>4.0.0</modelVersion>

diff --git a/components/org.wso2.carbon.identity.oauth.par/pom.xml b/components/org.wso2.carbon.identity.oauth.par/pom.xml
@@ -23,7 +23,7 @@
         <groupId>org.wso2.carbon.identity.inbound.auth.oauth2</groupId>
         <artifactId>identity-inbound-auth-oauth</artifactId>
         <relativePath>../../pom.xml</relativePath>
-        <version>6.11.224-SNAPSHOT</version>
+        <version>6.11.233-SNAPSHOT</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

diff --git a/components/org.wso2.carbon.identity.oauth.scope.endpoint/pom.xml b/components/org.wso2.carbon.identity.oauth.scope.endpoint/pom.xml
@@ -22,7 +22,7 @@
         <groupId>org.wso2.carbon.identity.inbound.auth.oauth2</groupId>
         <artifactId>identity-inbound-auth-oauth</artifactId>
         <relativePath>../../pom.xml</relativePath>
-        <version>6.11.224-SNAPSHOT</version>
+        <version>6.11.233-SNAPSHOT</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

diff --git a/components/org.wso2.carbon.identity.oauth.stub/pom.xml b/components/org.wso2.carbon.identity.oauth.stub/pom.xml
@@ -22,7 +22,7 @@
         <groupId>org.wso2.carbon.identity.inbound.auth.oauth2</groupId>
         <artifactId>identity-inbound-auth-oauth</artifactId>
         <relativePath>../../pom.xml</relativePath>
-        <version>6.11.224-SNAPSHOT</version>
+        <version>6.11.233-SNAPSHOT</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

diff --git a/components/org.wso2.carbon.identity.oauth.ui/pom.xml b/components/org.wso2.carbon.identity.oauth.ui/pom.xml
@@ -22,7 +22,7 @@
         <groupId>org.wso2.carbon.identity.inbound.auth.oauth2</groupId>
         <artifactId>identity-inbound-auth-oauth</artifactId>
         <relativePath>../../pom.xml</relativePath>
-        <version>6.11.224-SNAPSHOT</version>
+        <version>6.11.233-SNAPSHOT</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

diff --git a/components/org.wso2.carbon.identity.oauth/pom.xml b/components/org.wso2.carbon.identity.oauth/pom.xml
@@ -23,7 +23,7 @@
         <groupId>org.wso2.carbon.identity.inbound.auth.oauth2</groupId>
         <artifactId>identity-inbound-auth-oauth</artifactId>
         <relativePath>../../pom.xml</relativePath>
-        <version>6.11.224-SNAPSHOT</version>
+        <version>6.11.233-SNAPSHOT</version>
     </parent>
 
     <modelVersion>4.0.0</modelVersion>

diff --git a/...on.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth/OAuthAdminServiceImpl.java b/...on.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth/OAuthAdminServiceImpl.java
@@ -611,7 +611,7 @@ private void validateBindingType(String bindingType) throws IdentityOAuthClientE
     private void validateFAPIBindingType(String bindingType)
             throws IdentityOAuthClientException {
 
-        if (OAuth2Constants.TokenBinderType.CERTIFICATE_BASED_TOKEN_BINDER.equals(bindingType)) {
+        if (OAuth2Constants.TokenBinderType.CERTIFICATE_BASED_TOKEN_BINDER.equals(bindingType) || bindingType == null) {
             return;
         } else {
             String msg = String.format("Certificate bound access tokens is required. '%s' binding type is found.",

diff --git a/...rg.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth/OAuthUtil.java b/...rg.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth/OAuthUtil.java
@@ -467,7 +467,7 @@ public static IdentityOAuthAdminException handleErrorWithExceptionType(String me
             handleError(message, exception);
         }
         if (exception instanceof IdentityOAuth2ClientException) {
-            return new IdentityOAuthClientException(exception.getErrorCode(), message, exception);
+            return new IdentityOAuthClientException(exception.getErrorCode(), message);
         } else if (exception instanceof IdentityOAuth2ServerException) {
             return new IdentityOAuthServerException(exception.getErrorCode(), message, exception);
         } else {