Source:
<code>private Response process(MultivaluedMap<String, String> params) { String clientId = AuthorizationEndpointRequestParserProcessor.getClientId(event, session, params); checkSsl(); checkRealm(); checkClient(clientId); request = AuthorizationEndpointRequestParserProcessor.parseRequest(event, session, client, params); checkRedirectUri(); Response errorResponse = checkResponseType(); if (errorResponse != null) { return errorResponse; } if (request.getInvalidRequestMessage() != null) { event.error(Errors.INVALID_REQUEST); return redirectErrorToClient(parsedResponseMode, Errors.INVALID_REQUEST, request.getInvalidRequestMessage()); } if (!TokenUtil.isOIDCRequest(request.getScope())) { ServicesLogger.LOGGER.oidcScopeMissing(); } if (!TokenManager.isValidScope(request.getScope(), client)) { ServicesLogger.LOGGER.invalidParameter(OIDCLoginProtocol.SCOPE_PARAM); event.error(Errors.INVALID_REQUEST); return redirectErrorToClient(parsedResponseMode, OAuthErrorException.INVALID_REQUEST, "Invalid scopes: " + request.getScope()); } errorResponse = checkOIDCParams(); if (errorResponse != null) { return errorResponse; } errorResponse = checkPKCEParams(); if (errorResponse != null) { return errorResponse; } try { <START> ClientPolicyManager.triggerOnAuthorizationRequest(parsedResponseType, request, redirectUri, session); <END> } catch (ClientPolicyException cpe) { return redirectErrorToClient(parsedResponseMode, cpe.getError(), cpe.getErrorDetail()); } authenticationSession = createAuthenticationSession(client, request.getState()); updateAuthenticationSession(); CacheControlUtil.noBackButtonCacheControlHeader(); switch (action) { case REGISTER: return buildRegister(); case FORGOT_CREDENTIALS: return buildForgotCredential(); case CODE: return buildAuthorizationCodeAuthorizationResponse(); } throw new RuntimeException("Unknown action " + action); }</code><technical_language>following. problematic a ClientPolicyManager interface in keycloak-server-spi, DefaultClientPolicyManager in services</technical_language>

Target:
private Response process(MultivaluedMap<String, String> params) { String clientId = AuthorizationEndpointRequestParserProcessor.getClientId(event, session, params); checkSsl(); checkRealm(); checkClient(clientId); request = AuthorizationEndpointRequestParserProcessor.parseRequest(event, session, client, params); checkRedirectUri(); Response errorResponse = checkResponseType(); if (errorResponse != null) { return errorResponse; } if (request.getInvalidRequestMessage() != null) { event.error(Errors.INVALID_REQUEST); return redirectErrorToClient(parsedResponseMode, Errors.INVALID_REQUEST, request.getInvalidRequestMessage()); } if (!TokenUtil.isOIDCRequest(request.getScope())) { ServicesLogger.LOGGER.oidcScopeMissing(); } if (!TokenManager.isValidScope(request.getScope(), client)) { ServicesLogger.LOGGER.invalidParameter(OIDCLoginProtocol.SCOPE_PARAM); event.error(Errors.INVALID_REQUEST); return redirectErrorToClient(parsedResponseMode, OAuthErrorException.INVALID_REQUEST, "Invalid scopes: " + request.getScope()); } errorResponse = checkOIDCParams(); if (errorResponse != null) { return errorResponse; } errorResponse = checkPKCEParams(); if (errorResponse != null) { return errorResponse; } try { session.clientPolicy().triggerOnEvent(new AuthorizationRequestContext(parsedResponseType, request, redirectUri)); } catch (ClientPolicyException cpe) { return redirectErrorToClient(parsedResponseMode, cpe.getError(), cpe.getErrorDetail()); } authenticationSession = createAuthenticationSession(client, request.getState()); updateAuthenticationSession(); CacheControlUtil.noBackButtonCacheControlHeader(); switch (action) { case REGISTER: return buildRegister(); case FORGOT_CREDENTIALS: return buildForgotCredential(); case CODE: return buildAuthorizationCodeAuthorizationResponse(); } throw new RuntimeException("Unknown action " + action); }