Default the grant allowlist when updating a connector without one

idp/dex/connector.go

@@ -119,12 +119,17 @@ func (p *Provider) UpdateConnector(ctx context.Context, cfg *ConnectorConfig) er
 			name = old.Name
 		}
 
+		grantTypes := old.GrantTypes
+		if len(grantTypes) == 0 {
+			grantTypes = slices.Clone(DefaultGrantTypes)
+		}
+
 		return storage.Connector{
 			ID:         cfg.ID,
 			Type:       old.Type,
 			Name:       name,
 			Config:     configData,
-			GrantTypes: old.GrantTypes,
+			GrantTypes: grantTypes,
 		}, nil
 	}); err != nil {
 		return fmt.Errorf("failed to update connector: %w", err)

idp/dex/connector_test.go

@@ -252,6 +252,28 @@ func TestConnectorGrantTypes(t *testing.T) {
 			"an empty list would re-enable token exchange for this connector")
 	})
 
+	t.Run("updating a connector stored without an allowlist sets the default", func(t *testing.T) {
+		p, cleanup := newTestProvider(t)
+		defer cleanup()
+
+		// Mimic a connector written by an older release.
+		require.NoError(t, p.storage.CreateConnector(ctx, storage.Connector{
+			ID:     "legacy-oidc",
+			Type:   "oidc",
+			Name:   "Legacy",
+			Config: []byte(`{"issuer":"https://accounts.example.com","clientID":"client-id"}`),
+		}))
+
+		require.NoError(t, p.UpdateConnector(ctx, &ConnectorConfig{
+			ID:           "legacy-oidc",
+			ClientSecret: "new-secret",
+		}))
+
+		conn, err := p.storage.GetConnector(ctx, "legacy-oidc")
+		require.NoError(t, err)
+		assert.Equal(t, DefaultGrantTypes, conn.GrantTypes)
+	})
+
 	t.Run("backfills connectors stored without an allowlist", func(t *testing.T) {
 		p, cleanup := newTestProvider(t)
 		defer cleanup()

idp/dex/provider.go

@@ -12,6 +12,7 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 	"sync"
 	"time"
@@ -123,7 +124,7 @@ func NewProvider(ctx context.Context, config *Config) (*Provider, error) {
 		Storage:                    stor,
 		SkipApprovalScreen:         true,
 		SupportedResponseTypes:     []string{"code"},
-		AllowedGrantTypes:          DefaultGrantTypes,
+		AllowedGrantTypes:          slices.Clone(DefaultGrantTypes),
 		ContinueOnConnectorFailure: true,
 		Logger:                     logger,
 		PrometheusRegistry:         prometheus.NewRegistry(),

management/server/idp/embedded.go

@@ -9,6 +9,7 @@ import (
 	"net/url"
 	"os"
 	"path"
+	"slices"
 	"strings"
 
 	"github.com/dexidp/dex/storage"
@@ -173,7 +174,7 @@ func (c *EmbeddedIdPConfig) ToYAMLConfig() (*dex.YAMLConfig, error) {
 	// the minimal set instead. Operators can still opt in to more by setting it.
 	grantTypes := c.GrantTypes
 	if len(grantTypes) == 0 {
-		grantTypes = dex.DefaultGrantTypes
+		grantTypes = slices.Clone(dex.DefaultGrantTypes)
 	}
 
 	cfg := &dex.YAMLConfig{