Matchers should return empty for null

[rodwiddowson]

For completeness I'll pop this in, it was reported here.

The getMatchingValues method in AttributeInOIDCRequestedClaimsMatcher returns null quite a lot.

the filters (both matchers and policy) return a tristate in which we distinguish between "worked but nothing resulted" and "failed". For the former case you need to return an empty set for the latter null.

This is a signal to the upper layers to "do the right thing" depending on whether this is a deny rule (in which case failure means "deny everything") or an accept rule (in which case failure means "accept nothing").

I'm sure you've seen the case, this is just FWIW

[hjmikkon]

Thanks, this is clearly a bug on our side and will be fixed to the next release.

[hjmikkon]

Fix released in v1.1.0.