Problem
After upgrading openid_connect and running the database updates (specifically
openid_connect_update_8200, which converts plugin configuration from the old
openid_connect.settings.* config objects to the new openid_connect_client
config entities), sites configured before end_session_endpoint was added to
defaultConfiguration() receive the following PHP 8 warning on every request
that touches the generic client:
Warning: Undefined array key "end_session_endpoint" in
Drupal\openid_connect\Plugin\OpenIDConnectClient\OpenIDConnectGenericClient
->getEndpoints() (line 186 of .../OpenIDConnectGenericClient.php)
Root cause
Two issues interact to produce this:
1. openid_connect_update_8200 copies settings verbatim
The update hook creates the new config entity directly from the stored settings
without merging in defaultConfiguration():
$settings = $configuration->get('settings');
$entity_storage->create(['settings' => $settings, ...])->save();
Any key added to defaultConfiguration() after a site first saved its client
config is permanently absent from the resulting entity.
2. setConfiguration() default merge is silently skipped
OpenIDConnectClientBase::setConfiguration() attempts to fall back to defaults:
$current_configuration = $this->configuration ?: $this->defaultConfiguration();
However, PluginBase::__construct() (Drupal core) already sets
$this->configuration = $configuration before the subclass constructor calls
setConfiguration(). Because $this->configuration is therefore never null or
empty, the ?: branch never reaches defaultConfiguration(), so missing keys such
as end_session_endpoint are never backfilled.
3. getEndpoints() accesses the key without a null guard
'end_session' => $this->configuration['end_session_endpoint'],
On PHP 8, accessing an undefined array key is a warning (it was silently null
on PHP 7).
Proposed fix
Minimal fix — guard the missing key in getEndpoints():
'end_session' => $this->configuration['end_session_endpoint'] ?? '',
More complete fix — make setConfiguration() always start from defaults,
regardless of what PluginBase::__construct() already set:
$current_configuration = array_merge(
$this->defaultConfiguration(),
$this->configuration ?? []
);
$this->configuration = array_merge($current_configuration, $configuration);Steps to reproduce
1. Install openid_connect with a generic client configured (client_id,
client_secret, authorization/token/userinfo endpoints set), using a version
predating the addition of end_session_endpoint to defaultConfiguration().
2. Update the module to a version that includes openid_connect_update_8200.
3. Run database updates (drush updb).
4. Trigger any code path that calls getPlugin()->getEndpoints() on the generic
client — for example, the login redirect or watchdog/log viewer.
5. Observe the PHP warning in the Drupal log.
Issue fork openid_connect-3585057
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #2
balagan commentedComment #3
balagan commented