AuthorizationService { private AuthenticatorState getAuthenticatorState(final String stateString) { try { BigInteger id = IdUtil.fromString(stateString); AuthenticatorState callbackState = session.get(AuthenticatorState.class, id); if (callbackState == null) { throw new InvalidRequestException(); } return callbackState; } catch (Exception e) { throw new InvalidRequestException(); } } @Inject  AuthorizationService(final Session session,
                                final SecurityContext securityContext,
                                final InjectionManager injector); @GET @Produces(MediaType.APPLICATION_JSON) @O2Client @ApiOperation(value = "OAuth2 Authorization endpoint.") Response authorizationRequest(
            @Context final UriInfo uriInfo,
            @Context final HttpServletRequest request,
            @Optional
            @QueryParam("authenticator") final AuthenticatorType authenticator,
            @Optional
            @ApiParam(required = true, allowableValues = "code,token")
            @QueryParam("response_type") final String responseType,
            @Optional
            @QueryParam("redirect_uri") final String redirectUrl,
            @Optional
            @ApiParam(example = "scope1 scope2")
            @QueryParam("scope") final String scope,
            @Optional
            @QueryParam("state") final String state); @GET @Path("/callback") @Produces(MediaType.APPLICATION_JSON) @ApiOperation(value = "3rd Party IdP Callback", hidden = true) Response authorizationCallback(
            @Context final UriInfo uriInfo,
            @Context final HttpServletRequest request,
            @Optional
            @DefaultValue("")
            @QueryParam("state") final String state);  }
@Test public void testCallbackStateWithInvalidClientType() throws Exception { Response r = target("/oauth2/authorize/callback") .queryParam("state", IdUtil.toString(ownerContext.getAuthenticatorState() .getId())) .request() .get(); URI location = r.getLocation(); MultivaluedMap<String, String> params = HttpUtil.parseQueryParams(location.getQuery()); assertEquals("valid.example.com", location.getHost()); assertEquals("/redirect", location.getPath()); assertEquals("invalid_request", params.getFirst("error")); assertNotNull(params.get("error_description")); }