Problem

After upgrading openid_connect and running the database updates (specifically
openid_connect_update_8200, which converts plugin configuration from the old
openid_connect.settings.* config objects to the new openid_connect_client
config entities), sites configured before end_session_endpoint was added to
defaultConfiguration() receive the following PHP 8 warning on every request
that touches the generic client:

Warning: Undefined array key "end_session_endpoint" in
Drupal\openid_connect\Plugin\OpenIDConnectClient\OpenIDConnectGenericClient
->getEndpoints() (line 186 of .../OpenIDConnectGenericClient.php)

Root cause

Two issues interact to produce this:

1. openid_connect_update_8200 copies settings verbatim

The update hook creates the new config entity directly from the stored settings
without merging in defaultConfiguration():

  $settings = $configuration->get('settings');
  $entity_storage->create(['settings' => $settings, ...])->save();

Any key added to defaultConfiguration() after a site first saved its client
config is permanently absent from the resulting entity.

2. setConfiguration() default merge is silently skipped

OpenIDConnectClientBase::setConfiguration() attempts to fall back to defaults:

$current_configuration = $this->configuration ?: $this->defaultConfiguration();

However, PluginBase::__construct() (Drupal core) already sets
$this->configuration = $configuration before the subclass constructor calls
setConfiguration(). Because $this->configuration is therefore never null or
empty, the ?: branch never reaches defaultConfiguration(), so missing keys such
as end_session_endpoint are never backfilled.

3. getEndpoints() accesses the key without a null guard

'end_session' => $this->configuration['end_session_endpoint'],

On PHP 8, accessing an undefined array key is a warning (it was silently null
on PHP 7).

Proposed fix

Minimal fix — guard the missing key in getEndpoints():

  'end_session' => $this->configuration['end_session_endpoint'] ?? '',

More complete fix — make setConfiguration() always start from defaults,
regardless of what PluginBase::__construct() already set:

  $current_configuration = array_merge(
    $this->defaultConfiguration(),
    $this->configuration ?? []
  );
  $this->configuration = array_merge($current_configuration, $configuration);

Steps to reproduce

1. Install openid_connect with a generic client configured (client_id,
client_secret, authorization/token/userinfo endpoints set), using a version
predating the addition of end_session_endpoint to defaultConfiguration().
2. Update the module to a version that includes openid_connect_update_8200.
3. Run database updates (drush updb).
4. Trigger any code path that calls getPlugin()->getEndpoints() on the generic
client — for example, the login redirect or watchdog/log viewer.
5. Observe the PHP warning in the Drupal log.

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

balagan created an issue. See original summary.

balagan’s picture

Issue summary: View changes
balagan’s picture

Issue summary: View changes