Fix parameter duplication in JWT Bearer grant requests causing AADSTS70003 errors

[Copilot]

Fix on_behalf_of token payload issue in Spring Boot 4.x/Spring Framework 7.x

Problem

• When using on_behalf_of grant type with Azure AD authentication in Spring Boot 4.x/Spring Framework 7.x
• Multiple parameter converters are merged using MultiValueMap.addAll() which appends values
• This causes grant_type to become [value, value] instead of [value]
• Results in error: AADSTS70003: The app requested an unsupported grant type 'urn:ietf:params:oauth:grant-type:jwt-bearer,urn:ietf:params:oauth:grant-type:jwt-bearer'

Solution

• Modified AadJwtBearerGrantRequestParametersConverter to flatten multi-valued parameters
• After calling delegate converter, iterate through parameters and use set() instead of add()
• Take first value for each key to preserve base implementation defaults
• This prevents grant_type duplication when multiple converters are composed

Testing

• Added test noDuplicateGrantTypeParameter to verify fix
• Test confirms grant_type has exactly one value, not duplicates
• All tests pass (2/2 in AadJwtBearerGrantRequestParametersConverterTests)

Technical Details

In Spring Boot 4.x / Spring Security 7.x, the architecture uses parameter converters instead of entity converters. When RestClientJwtBearerTokenResponseClient.addParametersConverter() is called multiple times, Spring Security merges the results using MultiValueMap.addAll(), causing duplicate values.

Our fix ensures that even though the delegate converter sets parameters, we flatten them to single values before returning, preventing duplicates when the response client merges multiple converters.

Files Changed

1. AadJwtBearerGrantRequestParametersConverter.java - Added flattening logic
2. AadJwtBearerGrantRequestParametersConverterTests.java - Added test for duplicate prevention
3. CHANGELOG.md - Documented the bug fix
4. Removed obsolete AadJwtBearerGrantRequestEntityConverterTests.java (not used in Spring Boot 4.x)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[BUG] On behalf of token payload is wrong in Spring boot 4.x / spring framework 7.x beta</issue_title>
<issue_description>
Describe the bug

When using the on_behalf_of grant type with Azure AD authentication, the AbstractRestClientOAuth2AccessTokenResponseClient incorrectly merges parameters from multiple converters (DefaultOAuth2TokenRequestParametersConverter and AadJwtBearerGrantRequestParameterConverter). This causes parameter values to be converted into lists instead of single values, resulting in duplicate grant type values being sent to the authorization server.

Exception or Stack Trace

[unsupported_grant_type] AADSTS70003: The app requested an unsupported grant type 'urn:ietf:params:oauth:grant-type:jwt-bearer,urn:ietf:params:oauth:grant-type:jwt-bearer'.

To Reproduce

1. Configure a Spring Boot application with Azure AD OAuth2 authentication
2. Set up an authorized client using the on_behalf_of grant type
3. Attempt to request an access token using the on-behalf-of flow
4. The request fails with the AADSTS70003 error due to malformed grant type parameter

Code Snippet

The issue occurs in the addParametersConverter() method in AbstractRestClientOAuth2AccessTokenResponseClient.java. When composing converters, the method uses MultiValueMap.addAll() which appends values to existing keys rather than replacing them:

public final void addParametersConverter(Converter<T, MultiValueMap<String, String>> parametersConverter) {
 // ... existing parameters from DefaultOAuth2TokenRequestParametersConverter
 MultiValueMap<String, String> parametersToAdd = parametersConverter.convert(authorizationGrantRequest);
 if (parametersToAdd != null) {
  parameters.addAll(parametersToAdd);  // This creates duplicate list values
 }
 return parameters;
}

Expected behavior

Parameters should be properly merged such that when multiple converters provide the same parameter key, the final value should be a single string value, not a list. The grant type should appear once as urn:ietf:params:oauth:grant-type:jwt-bearer, not duplicated.

Setup (please complete the following information):

• OS: macOS
• IDE: IntelliJ IDEA 2025.2.6
• Library/Libraries: com.azure.spring:spring-cloud-azure-starter:7.0.0-beta.1
• Java version: 25
• Frameworks: Spring Boot 4.0.1, Spring Security with OAuth2
• Build Tool: Maven
  </issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes [BUG] On behalf of token payload is wrong in Spring boot 4.x / spring framework 7.x beta #47657

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Netyyyy]

@copilot the base branch should be checkout from feature/springcloudazure-7.x

[Copilot]

@copilot the base branch should be checkout from feature/springcloudazure-7.x

I've rebased the PR onto feature/springcloudazure-7.x as requested. The changes have been adapted for Spring Boot 4.x/Spring Framework 7.x architecture:

• Modified AadJwtBearerGrantRequestParametersConverter instead of entity converter (which doesn't exist in Spring Security 7.x)
• Added parameter flattening logic to prevent duplicate grant_type values
• Added test noDuplicateGrantTypeParameter to verify the fix
• All tests pass (2/2)

The fix addresses the same root issue where MultiValueMap.addAll() causes parameter duplication, but using the parameter converter approach appropriate for Spring Boot 4.x.