feat: [IAS] Harden IAS Subdomain Resolution in OAuth2Service (#753)

Author: MatKuhr

cloudplatform/connectivity-oauth/src/main/java/com/sap/cloud/sdk/cloudplatform/connectivity/OAuth2Service.java

@@ -229,12 +229,16 @@ private String getTenantSubdomainOrNull( @Nullable final Tenant tenant )
             return null;
         }
 
-        if( !(tenant instanceof TenantWithSubdomain) ) {
+        if( !(tenant instanceof TenantWithSubdomain tenantWithSubdomain) ) {
             final String msg = "Unable to get subdomain of tenant '%s' because the instance is not an instance of %s.";
             throw new DestinationAccessException(msg.formatted(tenant, TenantWithSubdomain.class.getSimpleName()));
         }
-
-        return ((TenantWithSubdomain) tenant).getSubdomain();
+        final var subdomain = tenantWithSubdomain.getSubdomain();
+        if( subdomain == null ) {
+            throw new DestinationAccessException(
+                "The given tenant '%s' does not have a subdomain defined.".formatted(tenant));
+        }
+        return subdomain;
     }
 
     @Nullable

cloudplatform/connectivity-oauth/src/test/java/com/sap/cloud/sdk/cloudplatform/connectivity/OAuth2ServiceTest.java

@@ -175,6 +175,11 @@ void testSubdomainTenantStrategy()
             TenantAccessor.executeWithTenant(new DefaultTenant("t1", "localhost"), service::retrieveAccessToken);
             TenantAccessor.executeWithTenant(new DefaultTenant("t2", "localhost"), service::retrieveAccessToken);
 
+            // if a tenant is explicitly defined, the subdomain is mandatory for the subdomain strategy
+            assertThatThrownBy(
+                () -> TenantAccessor.executeWithTenant(new DefaultTenant("t3"), service::retrieveAccessToken))
+                .hasMessageContaining("does not have a subdomain");
+
             SERVER_1
                 .verify(
                     1,

release_notes.md

@@ -8,7 +8,8 @@
 
 ### 🔧 Compatibility Notes
 
-- 
+- Changed a behavior details when obtaining tokens from IAS with the default strategy `CURRENT_TENANT`. 
+  In case the current tenant is the provider tenant, and `TenantAccessor.getCurrentTenant()` is returning a `Tenant` object, this object is now required to have a subdomain != null.
 
 ### ✨ New Functionality