JakartaServletUtils should check for x509 certificate in request attribute jakarta.servlet.request.X509Certificate

[Jesper]

Maybe JakartaServletUtils should first check jakarta.servlet.request.X509Certificate for certificate and if not found it could check javax.servlet.request.X509Certificate?

https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/src/d8dce80762e10da5972bf9cfb94dbada898ac59f/src/main/java/com/nimbusds/oauth2/sdk/http/JakartaServletUtils.java#lines-327

‌

[Yavor Vasilev]

Thanks for the report

[Yavor Vasilev]

Fixed here: f4f11d20c7ef4334e8444a38dc7ad4cc53997514

[Yavor Vasilev]

Released as

version 10.15 (2023-09-14)
    * Deprecates DefaultRPMetadataPolicyFactory, explicit client registration
      in OpenID Connect Federation 1.0 no longer uses metadata policies in the
      explicit client registration response.
    * The JakartaServletUtils.extractClientX509Certificate must use the
      "jakarta.servlet.request.X509Certificate" servlet attribute to obtain the
      client X509Certificate chain (iss #437).

Happy coding

[Jesper]

Fantastic support! Thank you very much