Merge pull request #1140 from DuendeSoftware/joe/optimized-raw-values

Fixes ToOptimizedRawValues to handle multiple resource values when combined with resource indicators
DuendeSoftware · Jan 25, 2023 · 88a0d88 · 88a0d88
2 parents 704366c + 93c8d8c
commit 88a0d88
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 1 deletion.
diff --git a/src/IdentityServer/Extensions/ValidatedAuthorizeRequestExtensions.cs b/src/IdentityServer/Extensions/ValidatedAuthorizeRequestExtensions.cs
@@ -157,7 +157,10 @@ private static NameValueCollection ToOptimizedRawValues(this ValidatedAuthorizeR
                     key == OidcConstants.AuthorizeRequest.ResponseType || 
                     request.RequestObjectValues.All(x => x.Type != key))
                 {
-                    collection.Add(key, request.Raw[key]);
+                    foreach(var value in request.Raw.GetValues(key))
+                    {
+                        collection.Add(key, value);
+                    }
                 }
             }
 

diff --git a/test/IdentityServer.UnitTests/Extensions/ValidatedAuthorizeRequestExtensionsTests.cs b/test/IdentityServer.UnitTests/Extensions/ValidatedAuthorizeRequestExtensionsTests.cs
@@ -3,6 +3,7 @@
 
 
 using Duende.IdentityServer.Validation;
+using IdentityModel;
 using Xunit;
 
 namespace UnitTests.Extensions;
@@ -26,4 +27,22 @@ public void GetAcrValues_should_return_snapshot_of_values()
             request.RemoveAcrValue(acr);
         }
     }
+
+    [Fact]
+    public void ToOptimizedFullDictionary_should_return_dictionary_with_array_for_repeated_keys_when_request_objects_are_used()
+    {
+        var request = new ValidatedAuthorizeRequest()
+        {
+            Raw = new System.Collections.Specialized.NameValueCollection
+            {
+                { OidcConstants.AuthorizeRequest.Request, "Request object here" },
+                { OidcConstants.AuthorizeRequest.Resource, "Resource1" },
+                { OidcConstants.AuthorizeRequest.Resource, "Resource2" },
+            }
+        };
+
+        var res = request.ToOptimizedFullDictionary();
+
+        Assert.Equal(2, res[OidcConstants.AuthorizeRequest.Resource].Length);
+    }
 }