Use case-insensitive DPoP scheme check

Author: sberyozkin

extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/BearerAuthenticationMechanism.java

@@ -60,7 +60,7 @@ private static void setCertificateThumbprint(RoutingContext context, OidcTenantC
     }
 
     private static void setDPopProof(RoutingContext context, OidcTenantConfig oidcTenantConfig, String token) {
-        if (OidcConstants.DPOP_SCHEME.equals(oidcTenantConfig.token().authorizationScheme())) {
+        if (OidcUtils.isDPoPScheme(oidcTenantConfig.token().authorizationScheme())) {
 
             List<String> proofs = context.request().headers().getAll(OidcConstants.DPOP_SCHEME);
             if (proofs == null || proofs.isEmpty()) {

extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcUtils.java

@@ -916,4 +916,8 @@ public static String decryptToken(TenantConfigContext resolvedContext, String to
         }
         return token;
     }
+
+    public static boolean isDPoPScheme(String authorizationScheme) {
+        return OidcConstants.DPOP_SCHEME.equalsIgnoreCase(authorizationScheme);
+    }
 }

extensions/oidc/runtime/src/test/java/io/quarkus/oidc/runtime/OidcUtilsTest.java

@@ -33,6 +33,15 @@
 
 public class OidcUtilsTest {
 
+    @Test
+    public void testDpopScheme() throws Exception {
+
+        assertTrue(OidcUtils.isDPoPScheme("DPoP"));
+        assertTrue(OidcUtils.isDPoPScheme("dpop"));
+        assertFalse(OidcUtils.isDPoPScheme("pop"));
+
+    }
+
     @Test
     public void testGetSingleSessionCookie() throws Exception {