OidcClientImpl does not properly declare a dependency on SecurityService

[jensengelke]

https://github.com/OpenLiberty/open-liberty/blob/release-22.0.0.3/dev/com.ibm.ws.security.openidconnect.client/bnd.bnd should have an entry like

securityService=com.ibm.ws.security.SecurityService; \
dynamic:='oidcClientConfig,sslSupport,authFilter,securityService'; \

When invoking request.logout() from a ServletFilter intercepting traffic to form-based logout URL ibm_security_logout on 22.0.0.3, we see a NPE:

Stack Dump = java.lang.NullPointerException
        at com.ibm.ws.security.openidconnect.client.internal.OidcClientImpl.authenticateSubject(OidcClientImpl.java:749)
        at com.ibm.ws.security.openidconnect.client.internal.OidcClientImpl.handleOidcCookie(OidcClientImpl.java:722)
        at com.ibm.ws.security.openidconnect.client.internal.OidcClientImpl.logout(OidcClientImpl.java:663)
        at com.ibm.ws.webcontainer.security.AuthenticateApi.logoutUnprotectedResourceServiceRef(AuthenticateApi.java:244)
        at com.ibm.ws.webcontainer.security.AuthenticateApi.logout(AuthenticateApi.java:189)
        at com.ibm.ws.webcontainer.security.AuthenticateApi.logoutServlet30(AuthenticateApi.java:627)
        at com.ibm.ws.webcontainer.security.WebAppSecurityCollaboratorImpl.logout(WebAppSecurityCollaboratorImpl.java:1212)
        at com.ibm.ws.webcontainer.srt.SRTServletRequest.logout(SRTServletRequest.java:3956)
        at javax.servlet.http.HttpServletRequestWrapper.logout(HttpServletRequestWrapper.java:376)
        at com.ibm.bpm.servlet.filters.GenericSecurityServletFilter.doFilter(GenericSecurityServletFilter.java:327)
        at com.ibm.ws.webcontainer.filter.FilterInstanceWrapper.doFilter(FilterInstanceWrapper.java:201)

FYI @teddyjtorres

[jensengelke]

The target release for a shipment invoking this code is Liberty 22.0.0.9

[arunavemulapalli]

Jens, Closed this issue as the fix is already verified