Password grant does not trim the whitespaces in the username

[rksk]

Describe the issue: If we invoke the password grant with whitespaces at the beginning or the end, the sub of the issued id_token contains the same username with whitespace while the real user on the userstore does not have whitespace in the username.

The same issue is existing in the basic authenticator and we have avoided it by trimming the username in the authentication endpoint.

How to reproduce:

• Invoke the password grant with whitespace on either side of the username

  curl -kv -u CI:CK -d "grant_type=password&username=admin &password=admin&scope=openid" "https://localhost:9443/oauth2/token"

• The sub in id_tokne will contain the same username whitespaces

  "sub": "admin ",

Expected behavior: The sub should contain the correct username on the userstore

Environment information

• Product Version: All

[mefarazath]

@janakamarasena @senthalan Will we ever need to allow leading space or trailing in any request parameters in the /oauth2/token request?

I am thinking rather than handling this specifically for the password grant, to remove leading and trailing whitespaces on all grant type params. WDYT?

[senthalan]

@janakamarasena @senthalan Will we ever need to allow leading space or trailing in any request parameters in the /oauth2/token request?

I am thinking rather than handling this specifically for the password grant, to remove leading and trailing whitespaces on all grant type params. WDYT? +1

And I think it is better to handle trimming the space in the server-side as well. I hope this method will be used by all the authenticators which handler the username input.

https://github.com/wso2/carbon-identity-framework/blob/v5.18.218/components/authentication-framework/org.wso2.carbon.identity.application.authentication.framework/src/main/java/org/wso2/carbon/identity/application/authentication/framework/util/FrameworkUtils.java#L2660

[janakamarasena]

+1 for the suggestions. We shouldn't need leading or trailing whitespace.

[chamathns]

Migara Pramod will work on this.