[vharseko]

Fixes #1195

Problem

Since #1058 the OpenID Connect discovery document (/oauth2/.well-known/openid-configuration) has advertised revocation_endpoint at <base>/revoke, but TokenRevocationResource is attached only at /token/revoke (OAuth2RouterProvider). A request to the advertised URL falls through to the default route of RestletRealmRouter, which takes revoke for a subrealm name, and answers 404, so a client that takes its endpoints from discovery never revokes a token. Affects 16.1.2, 16.1.3 and 16.1.4.

Changes

• OAuth2UrisFactory.OAuth2UrisImpl.getRevocationEndpoint() returns <base>/token/revoke, the routed path that the admin guide (chap-oauth2.adoc) and the developer guide (chap-client-dev.adoc) document. No route is added at /revoke: the advertised URL has never worked, so no client can depend on it.
• The discovery document also advertises introspection_endpoint (RFC 8414), served at <base>/introspect. OAuth2Uris.getIntrospectionEndpoint() and the route already existed, but the endpoint was not published.

Tests

DiscoveryEndpointRoutingTest builds the discovery document with the real OpenIDConnectProviderConfiguration and OAuth2UrisImpl, resolves every endpoint it advertises through the router that OAuth2RouterProvider builds, and checks that each one reaches the resource implementing it: authorization, token, introspection, revocation, userinfo, check_session_iframe, end_session, jwks_uri, registration and device_authorization.

Before the fix, exactly two rows failed: introspection_endpoint was absent, and revocation_endpoint (…/oauth2/revoke) was routed to RestletRealmRouter$Delegate, the subrealm route. All ten pass after it, and the whole openam-oauth2 suite passes (909 tests).

Notes for review:

• The test extends GuiceTestCase, so openam-oauth2 gets the org.openidentityplatform.commons.guice:test test dependency (version managed by the root pom, as in openam-uma).
• The Guice modules on the openam-oauth2 test classpath cannot build an injector without a configured OpenAM (no bindings for the scripting ScriptEvaluator / ScriptLogger), and GuiceTestCase needs InjectorHolder to build one before it overrides it. So the test sets an empty module loader from @BeforeSuite, as AuditContextFilterTest and InjectorHolderTestSupport do. That setting is JVM wide; no other test in the module uses the injector, and the full suite runs green with it.
• The sample discovery response in chap-openid-connect.adoc is an old snapshot ("version": "3.0", no device_authorization_endpoint), so it is left as is.

[maximthomas]

praise: The fix sits where the bug is, and the new test resolves the discovery document through the real router.

• OAuth2UrisFactory.OAuth2UrisImpl.getRevocationEndpoint() now returns the path OAuth2RouterProvider actually routes (/token/revoke), and no /revoke route is added for a URL nobody could use.
• DiscoveryEndpointRoutingTest covers every URL-valued key OpenIDConnectProviderConfiguration.getConfiguration puts except issuer. It checks the resource each one reaches, not just the string, so the old /revoke value fails there on the /{subrealm} route.
• The JVM-wide empty module loader in @BeforeSuite is explained in the Javadoc, and the explanation holds. Without this class, the rest of the openam-oauth2 suite (899 tests) is green and loads no org.forgerock.guice.core class.