From e2c52ef2e0dabce0f436e61014f96ca39e87c4ee Mon Sep 17 00:00:00 2001
From: Duane May <duane.may@broadcom.com>
Date: Fri, 17 Jul 2026 16:28:00 -0400
Subject: [PATCH] Fix additionalConfiguration not mapped during YAML IdP
 bootstrap

OauthIDPWrapperFactoryBean#setCommonProperties() maps nearly every
field from a YAML-defined OAuth/OIDC identity provider onto the
provider definition, but silently skipped additionalConfiguration.
As a result, any provider bootstrapped from YAML always ends up with
additionalConfiguration == null, even when the manifest sets it,
while providers created/updated via the REST API are unaffected
since Jackson deserializes the field correctly there.

Add the missing mapping, following the same pattern used for the
other fields in this method, and add test coverage for both the
mapped and not-provided cases.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .../oauth/OauthIDPWrapperFactoryBean.java        |  1 +
 ...dentityProviderDefinitionFactoryBeanTest.java | 16 ++++++++++++++++
 2 files changed, 17 insertions(+)

diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/provider/oauth/OauthIDPWrapperFactoryBean.java b/server/src/main/java/org/cloudfoundry/identity/uaa/provider/oauth/OauthIDPWrapperFactoryBean.java
index 5e2575289ae..0fcb665f27f 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/provider/oauth/OauthIDPWrapperFactoryBean.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/provider/oauth/OauthIDPWrapperFactoryBean.java
@@ -148,6 +148,7 @@ protected void setCommonProperties(Map<String, Object> idpDefinitionMap, Abstrac
         idpDefinition.setTokenKey((String) idpDefinitionMap.get("tokenKey"));
         idpDefinition.setIssuer((String) idpDefinitionMap.get("issuer"));
         idpDefinition.setAttributeMappings((Map<String, Object>) idpDefinitionMap.get(ATTRIBUTE_MAPPINGS));
+        idpDefinition.setAdditionalConfiguration((Map<String, Object>) idpDefinitionMap.get("additionalConfiguration"));
         idpDefinition.setScopes((List<String>) idpDefinitionMap.get("scopes"));
         idpDefinition.setUserPropagationParameter((String) idpDefinitionMap.get("userPropagationParameter"));
         idpDefinition.setGroupMappingMode(parseExternalGroupMappingMode(idpDefinitionMap.get("groupMappingMode")));
diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/provider/oauth/OauthIdentityProviderDefinitionFactoryBeanTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/provider/oauth/OauthIdentityProviderDefinitionFactoryBeanTest.java
index 9b154059ed6..467597afc7d 100644
--- a/server/src/test/java/org/cloudfoundry/identity/uaa/provider/oauth/OauthIdentityProviderDefinitionFactoryBeanTest.java
+++ b/server/src/test/java/org/cloudfoundry/identity/uaa/provider/oauth/OauthIdentityProviderDefinitionFactoryBeanTest.java
@@ -119,6 +119,22 @@ void external_group_mapping_default_in_body() {
         assertThat(providerDefinition.getGroupMappingMode()).isNull();
     }
 
+    @Test
+    void additionalConfigurationIsMapped() {
+        Map<String, Object> additionalConfiguration = map(
+                entry("origin_override", map(entry("uaa", "uaa")))
+        );
+        idpDefinitionMap.put("additionalConfiguration", additionalConfiguration);
+        factoryBean.setCommonProperties(idpDefinitionMap, providerDefinition);
+        assertThat(providerDefinition.getAdditionalConfiguration()).containsExactlyInAnyOrderEntriesOf(additionalConfiguration);
+    }
+
+    @Test
+    void additionalConfigurationIsNullWhenNotProvided() {
+        factoryBean.setCommonProperties(idpDefinitionMap, providerDefinition);
+        assertThat(providerDefinition.getAdditionalConfiguration()).isNull();
+    }
+
     @Test
     void jwtClientAuthenticationTrue() {
         Map<String, Map> definitions = new HashMap<>();