Part of OpenConext/OpenConext-myconext#1050

Author: oharsta

Changelog.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 8.4.0
+- Only call the `/attribute-manipulation` in the `/introspect` endpoint when the Resource Server has an institutionGUID ([#1050](https://github.com/OpenConext/OpenConext-myconext/issues/1050))
+- Upgrade to Spring Boot 3.5.8
+
 ## 8.3.0
 - Only call the `/attribute-manipulation` in the `/introspect` endpoint when entityID's and institutionGUID's are different ([#1041](https://github.com/OpenConext/OpenConext-myconext/issues/1041))
 

oidc/src/main/java/oidc/eduid/AttributePseudonymisation.java

@@ -65,7 +65,11 @@ public Optional<Map<String, String>> pseudonymise(OpenIDClient resourceServer, O
             resourceServerEquals,
             institutionGuidEquals
         ));
-
+        if (enabled && !StringUtils.hasText(resourceServerInstitutionGuid)) {
+            LOG.warn("Skipping attribute manipulation and returning empty result for 'pseudonymise' because there is" +
+                "no InstitutionGuid for RS: " + resourceServer.getClientId());
+            return Optional.empty();
+        }
         if (!enabled || !StringUtils.hasText(eduId) || !StringUtils.hasText(resourceServerInstitutionGuid) ||
             resourceServerEquals || institutionGuidEquals) {
             LOG.debug("Skipping attribute manipulation and returning empty result for 'pseudonymise'");

pom.xml

@@ -5,7 +5,7 @@
     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
-        <version>3.5.5</version>
+        <version>3.5.8</version>
         <relativePath/>
     </parent>