From 63dd0524e97246150177ca245932151abe6e21d8 Mon Sep 17 00:00:00 2001
From: Duane May <duane.may@broadcom.com>
Date: Mon, 27 Jul 2026 18:16:13 -0400
Subject: [PATCH] Propagate externalGroupsWhitelist for bootstrapped OAuth/OIDC
 IdPs

OauthIDPWrapperFactoryBean never read externalGroupsWhitelist from the
YAML-configured IdP definition map, so any OAuth/OIDC identity provider
bootstrapped via config always ended up with an empty whitelist,
silently dropping external group claims regardless of what was
configured. LDAP and SAML bootstrap paths already wire this property
through; OAuth/OIDC was missing it.
---
 .../oauth/OauthIDPWrapperFactoryBean.java         |  2 ++
 ...IdentityProviderDefinitionFactoryBeanTest.java | 15 +++++++++++++++
 2 files changed, 17 insertions(+)

diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/provider/oauth/OauthIDPWrapperFactoryBean.java b/server/src/main/java/org/cloudfoundry/identity/uaa/provider/oauth/OauthIDPWrapperFactoryBean.java
index 0fcb665f27f..0a16e9197da 100644
--- a/server/src/main/java/org/cloudfoundry/identity/uaa/provider/oauth/OauthIDPWrapperFactoryBean.java
+++ b/server/src/main/java/org/cloudfoundry/identity/uaa/provider/oauth/OauthIDPWrapperFactoryBean.java
@@ -36,6 +36,7 @@
 import static org.cloudfoundry.identity.uaa.constants.OriginKeys.OAUTH20;
 import static org.cloudfoundry.identity.uaa.constants.OriginKeys.OIDC10;
 import static org.cloudfoundry.identity.uaa.provider.ExternalIdentityProviderDefinition.ATTRIBUTE_MAPPINGS;
+import static org.cloudfoundry.identity.uaa.provider.ExternalIdentityProviderDefinition.EXTERNAL_GROUPS_WHITELIST;
 import static org.cloudfoundry.identity.uaa.provider.ExternalIdentityProviderDefinition.STORE_CUSTOM_ATTRIBUTES_NAME;
 import static org.springframework.util.StringUtils.hasText;
 
@@ -148,6 +149,7 @@ protected void setCommonProperties(Map<String, Object> idpDefinitionMap, Abstrac
         idpDefinition.setTokenKey((String) idpDefinitionMap.get("tokenKey"));
         idpDefinition.setIssuer((String) idpDefinitionMap.get("issuer"));
         idpDefinition.setAttributeMappings((Map<String, Object>) idpDefinitionMap.get(ATTRIBUTE_MAPPINGS));
+        idpDefinition.setExternalGroupsWhitelist((List<String>) idpDefinitionMap.get(EXTERNAL_GROUPS_WHITELIST));
         idpDefinition.setAdditionalConfiguration((Map<String, Object>) idpDefinitionMap.get("additionalConfiguration"));
         idpDefinition.setScopes((List<String>) idpDefinitionMap.get("scopes"));
         idpDefinition.setUserPropagationParameter((String) idpDefinitionMap.get("userPropagationParameter"));
diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/provider/oauth/OauthIdentityProviderDefinitionFactoryBeanTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/provider/oauth/OauthIdentityProviderDefinitionFactoryBeanTest.java
index 467597afc7d..992595b0f62 100644
--- a/server/src/test/java/org/cloudfoundry/identity/uaa/provider/oauth/OauthIdentityProviderDefinitionFactoryBeanTest.java
+++ b/server/src/test/java/org/cloudfoundry/identity/uaa/provider/oauth/OauthIdentityProviderDefinitionFactoryBeanTest.java
@@ -25,11 +25,13 @@
 
 import java.util.Collections;
 import java.util.HashMap;
+import java.util.List;
 import java.util.Map;
 import java.util.Set;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.cloudfoundry.identity.uaa.provider.ExternalIdentityProviderDefinition.EXTERNAL_GROUPS_WHITELIST;
 import static org.cloudfoundry.identity.uaa.provider.ExternalIdentityProviderDefinition.GROUP_ATTRIBUTE_NAME;
 import static org.cloudfoundry.identity.uaa.provider.ExternalIdentityProviderDefinition.STORE_CUSTOM_ATTRIBUTES_NAME;
 import static org.cloudfoundry.identity.uaa.util.UaaMapUtils.entry;
@@ -119,6 +121,19 @@ void external_group_mapping_default_in_body() {
         assertThat(providerDefinition.getGroupMappingMode()).isNull();
     }
 
+    @Test
+    void external_groups_whitelist_default_is_empty() {
+        factoryBean.setCommonProperties(idpDefinitionMap, providerDefinition);
+        assertThat(providerDefinition.getExternalGroupsWhitelist()).isEmpty();
+    }
+
+    @Test
+    void external_groups_whitelist_in_body() {
+        idpDefinitionMap.put(EXTERNAL_GROUPS_WHITELIST, List.of("*"));
+        factoryBean.setCommonProperties(idpDefinitionMap, providerDefinition);
+        assertThat(providerDefinition.getExternalGroupsWhitelist()).containsExactly("*");
+    }
+
     @Test
     void additionalConfigurationIsMapped() {
         Map<String, Object> additionalConfiguration = map(