Source:
<code>public boolean validate(final J2EContext context) { val request = context.getRequest(); val checkParameterExist = Stream.of(OAuth20Constants.CLIENT_ID, OAuth20Constants.REDIRECT_URI, OAuth20Constants.RESPONSE_TYPE) .allMatch(s -> HttpRequestUtils.doesParameterExist(request, s)); if (!checkParameterExist) { LOGGER.warn("Missing required parameters (client id, redirect uri, etc) for response type [{}].", getResponseType()); return false; } val responseType = request.getParameter(OAuth20Constants.RESPONSE_TYPE); if (!OAuth20Utils.checkResponseTypes(responseType, OAuth20ResponseTypes.values())) { LOGGER.warn("Response type is not supported.", responseType); return false; } val clientId = request.getParameter(OAuth20Constants.CLIENT_ID); val registeredService = getRegisteredServiceByClientId(clientId); <START> if (registeredService == null) { <END> LOGGER.warn("Registered service for {}=[{}] is not registered", OAuth20Constants.CLIENT_ID, clientId); return false; } val service = webApplicationServiceServiceFactory.createService(registeredService.getServiceId()); val audit = AuditableContext.builder() .service(service) .registeredService(registeredService) .build(); val accessResult = this.registeredServiceAccessStrategyEnforcer.execute(audit); if (accessResult.isExecutionFailure()) { LOGGER.warn("Registered service is not found or is not authorized for access.", registeredService); return false; } val redirectUri = request.getParameter(OAuth20Constants.REDIRECT_URI); if (!OAuth20Utils.checkCallbackValid(registeredService, redirectUri)) { LOGGER.warn("Callback URL is not authorized for registered service [{}].", redirectUri, registeredService); return false; } return OAuth20Utils.isAuthorizedResponseTypeForService(context, registeredService); }</code><technical_language>This right. need registeredServiceAccessStrategyEnforcer do job, null object here: java webApplicationServiceServiceFactory.createService(registeredService.getServiceId()); this: java val registeredService = getRegisteredServiceByClientId(clientId); val service = registeredService != null ? webApplicationServiceServiceFactory.createService(registeredService.getServiceId()) : null; ...which registeredServiceAccessStrategyEnforcer handle access-related behavior</technical_language>

Target:
public boolean validate(final J2EContext context) { val request = context.getRequest(); val checkParameterExist = Stream.of(OAuth20Constants.CLIENT_ID, OAuth20Constants.REDIRECT_URI, OAuth20Constants.RESPONSE_TYPE) .allMatch(s -> HttpRequestUtils.doesParameterExist(request, s)); if (!checkParameterExist) { LOGGER.warn("Missing required parameters (client id, redirect uri, etc) for response type [{}].", getResponseType()); return false; } val responseType = request.getParameter(OAuth20Constants.RESPONSE_TYPE); if (!OAuth20Utils.checkResponseTypes(responseType, OAuth20ResponseTypes.values())) { LOGGER.warn("Response type is not supported.", responseType); return false; } val clientId = request.getParameter(OAuth20Constants.CLIENT_ID); val registeredService = getRegisteredServiceByClientId(clientId); val service = registeredService != null ? webApplicationServiceServiceFactory.createService(registeredService.getServiceId()) : null; val audit = AuditableContext.builder() .service(service) .registeredService(registeredService) .build(); val accessResult = this.registeredServiceAccessStrategyEnforcer.execute(audit); if (accessResult.isExecutionFailure()) { LOGGER.warn("Registered service is not found or is not authorized for access.", registeredService); return false; } val redirectUri = request.getParameter(OAuth20Constants.REDIRECT_URI); if (!OAuth20Utils.checkCallbackValid(registeredService, redirectUri)) { LOGGER.warn("Callback URL is not authorized for registered service [{}].", redirectUri, registeredService); return false; } return OAuth20Utils.isAuthorizedResponseTypeForService(context, registeredService); }