SystemScopesIssuer NullPointerException on Token Exchange with Third-Party Key Manager

[Nareash503536]

Environment

Component	Version
WSO2 API Manager	4.6.0
WSO2 Identity Server	6.1.0 (offset = 1)

---

Description

When using the token exchange grant type (urn:ietf:params:oauth:grant-type:token-exchange) with a third-party key manager (IS 6.1.0), APIM throws a NullPointerException in SystemScopesIssuer because the IDP is looked up by JWT issuer value using getIdPByName(), but the auto-generated IDP name created during key manager setup does not match the JWT issuer.

---

Error

ERROR - SystemScopesIssuer No Registered IDP found for the JWT with issuer name: https://<IDP_ISSUER>/oauth2/token
java.lang.NullPointerException: Cannot invoke "...IdentityProvider.getClaimConfig()" because "ajc$this.identityProvider" is null

at SystemScopesIssuer.java:608

---

Steps to Reproduce

1. Set up IS 6.1.0 (offset=1) and APIM 4.6.0. Configure a third-party key manager in APIM Admin Portal pointing to IS.
2. Note that the auto-created IDP name in APIM Management Console does not match the JWT issuer value.
3. Create a Dev Portal application and enable the token-exchange grant type.
4. Obtain a token from IS via client_credentials, then use it in a token exchange request against APIM:

curl 'https://localhost:9443/oauth2/token' \
  -H 'Authorization: Basic <base64>' \
  --data-urlencode 'grant_type=urn:ietf:params:oauth:grant-type:token-exchange' \
  --data-urlencode 'subject_token_type=urn:ietf:params:oauth:token-type:jwt' \
  --data-urlencode 'subject_token=<IS_access_token>'

5. Observe the NPE in logs.

---

[AqeelMuhammad]

Duplicate of wso2/api-manager#2167 & wso2/api-manager#4790

[AqeelMuhammad]

Master Fixes;

• Fixing IdP field issue during scope validation wso2-extensions/apim-km-wso2is#70
• Fix token exchange grant IDP not resolving issue carbon-apimgt#13714