How to disable the delegatedclientid HTTP parameter in a OpenIDConnect?

[Boris P1]

Good morning all,

We are doing the migration of CAS to its 5.3.9 version.
The step we are attempting to realize is the authentication delegation with OIDC.
Always according to the apereo.github documentation, we implement the CAS overlay template to reach it.
Nevertheless, we have recently discovered that the Maven dependency related to pac4j, cas-server-support-pac4j-webflow, does not respect rigorously the OIDC protocol because one class does force the delegatedclientid HTTP parameter to be in the URL handled by FranceConnect (implementing OIDC), which is explicitly not necessary with OIDC.
The concerning class is the following:
org.apereo.cas.web.DelegatedClientWebflowManager
Which is here:

https://github.com/apereo/cas/blob/master/support/cas-server-support-pac4j-webflow/src/main/java/org/apereo/cas/web/DelegatedClientWebflowManager.java

During the delegation process, FranceConnect stops it and specifies some informations about this parameter:
"The following fields are not supposed to be present : delegatedclientid"
For information, the different existing HTTP parameters in the URL are the following:
scope
response_type
redirect_uri
state
nonce
delegatedclientid
client_id

Please, is this parameter very necessary in this class or is there a way to disable it?

Boris.

[Boris P1]

I made a proposal of solution here:

https://github.com/apereo/cas/pull/3981

following the Maven overlay principle.

I precise that all the classes needed via the imports in the Java class DelegatedClientWebflowManager are available thanks to new dependencies added in the pom.xml.

Boris.