Working group proposal: OIDC improvements

[sberyozkin]

Goal

The goal of this working group is to improve quarkus-oidc by:

• implementing important new security features
• continuing with improving the way OIDC requests can be intercepted
• prioritizing on some other open issues such as using JWT bearer client authentication to complete the authorization code flow
• engaging with the community and understanding what may have to be simplified to improve a user experience

Progress tracking

Documentation improvements, simplifying dealing with properties

• #43737 Expanded OIDC configuration guide
• #21075 Create Security Guide Flow Diagram
• #45142 Minimize duplication in OIDC Bearer and Code flow docs
• #45011 Provide Vert.x OIDC to Quarkus OIDC migration guides

Token security elevation

• #46213 OAuth2 Step Up Authentication

Completed

• #33059 Create OIDC questionnaire
• #36250 OIDC Dynamic Client Registration
• #39185 Migrate OIDC extensions from ConfigGroup to ConfigMapping
• #42117 Add OIDC response fiters
• #40013 Support JWT bearer authentication to complete the code flow
• #41890 Return OIDC code flow error_code and error_description directly to the user in devmode
• #4482 Support for X509 certificate binding for quarkus-oidc
• #44958 Programmatic OIDC setup
• #42115 Support for DPoP for quarkus-oidc

End in Sight

This work is done when users respond to the OIDC questionnaire and the simplifications tasks, if identified, are completed.
All other listed tasks must be completed as well.

[cescoffier]

Thanks @sberyozkin !

Can you tell us more about the "OIDC questionnaire", it's the first time I hear about it (or, I totally forget about ti, which is totally possible).

[sberyozkin]

Can you tell us more about the "OIDC questionnaire", it's the first time I hear about it (or, I totally forget about ti, which is totally possible).

I want to collect feedback from Quarkus OIDC practitioners, who use it in prod, as well as from users who may have tried it. I'd like to understand what their experience is or has been, what features they use or miss, or what they think will help to push it to the next level.

I'll work on preparing a list of questions at #33059 and then once the questions are ready I'll ask in all the channels, where I can, to support the questionnaire. I'm a bit vague about mechanisms to make it work, but I'll figure it out

[cescoffier]

Awesome! Thanks! I may have missed the ping on the issue.
I'm looking forward to seeing the results.

[sberyozkin]

@cescoffier @maxandersen, I'd like to open a survey next week, I'd appreciate if we can have an announcement in the Discussions, as not everyone is on X or quarkus-dev.

[sberyozkin]

@maxandersen Please create an announcement in the next few days, here are the links again:

Shortened URL:

https://forms.gle/KaqdxMwdqb6W7ejP6

or, in the original form,
https://docs.google.com/forms/d/e/1FAIpQLScx1paouG2NnZ8-dtoLKlhpW2xmso-5ZRf2K3Ho4i9u_mhgqA/viewform?usp=sf_link

The proposed announcement title: Survey on OpenId Connect support, I propose to keep it open for 1 month, in the end we can summarize the feedback and let users know.

As far as I'm concerned, I don't plan to add more questions after discussing it with Michal and updating one of the questions, but if you or Clement would prefer to ask for something else, let me know and I'll update the form. Otherwise, let's open the survey when you will have time and I'll follow up with linking to it in other channels, thanks

[maxandersen]

first time looking - just a few comments:

• The first question "What is your experience with Quarkus OIDC ?" is missing a "No experience" or "other" option with possiblity to put comment.
• the second question is very demanding, maybe write it: "If you chose We tried to go to production with it but it did not work out in the previous question, can you outline what did not work:"

rest of questions are ok.

Where is it you want this announced? wouldn't blog and quarkus design discusion post be enough or?

[sberyozkin]

@maxandersen Thanks for the feedback, I updated the second question as you proposed; but I could not add Other option to the first dropdown list with an option to comment. I added a slightly expanded variation of your proposed No experience though, We have no experience with it but are planning to test it, because I guess, if someone has no experience with and no any plans about it, they can't complete the rest of the form anyway.

Where is it you want this announced? wouldn't blog and quarkus design discusion post be enough or?

IMHO, it should be in Announcements, otherwise, the design discussion will disappear from the 1st page probably early next week. I'll also support this announcement with X, quarkus-dev and Zulip messages; I'm not sure about it being a blog post...

[maxandersen]

I guess, if someone has no experience with and no any plans about it, they can't complete the rest of the form anyway.

let them be the decider of that. having the info such user provides can be useful and you can always filter it out.

[sberyozkin]

@maxandersen Sure :-), it is only We have no experience with it now :-)

[sberyozkin]

As far at the plan for the OIDC is concerned, apart from whatever we'll consider to look at following the survey results, elevation of the token security is a major theme right now.

I refer to the X509 token binding and DPoP.
We are literally 1 step away now from supporting the former option for FAPI applications, while the latter is poised to become the main tool for SPA applications, for ex, with Okta just publishing a blog entry about DPoP.

I'm going to prioritise on these 2 issues.

[sberyozkin]

Hi @maxandersen, here is a proposed title and text for the survey announcement:

Title: Survey on OpenId Connect support
Text:

We have opened a survey on the OpenId Connect (OIDC) support in Quarkus and it will remain open for 1 month.

If you have worked with, tried, or considered using the `quarkus-oidc` extension, please complete [this survey](https://forms.gle/KaqdxMwdqb6W7ejP6) and share with us your thoughts about pros and cons of working with and learning about Quarkus OIDC.

Expected survey completion time is 10-20 minutes. The survey is anonymous, you will not be asked to leave your email or other contact details.

Your feedback will be appreciated. 

Thank you !

Please tweak it as you'd like and do the announcement, and as I said, I'll follow up with messages in the other channels, thanks.

And, I'll close #33059 the moment the survey goes live :-)

[maxandersen]

live here: #43650

[sberyozkin]

Thanks @maxandersen

[sberyozkin]

@maxandersen @cescoffier I've updated the proposed list of actions for this proposed group. I'm not sure if it becomes a WG, but the plan is as follows:

• Documentation improvements and a programmatic setup - all these tasks are about making it easy to navigate the properties or minimize the necessity of dealing with them
• Providing options for hardening the token secuity: OIDC MTLS binding is nearly complete, and DPoP - to be tackled in 2025

Michal helped with a few of the completed issues, so we have at least 2 people involved.