Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

HTTP 'authenticated' policy returns HTTP 200 for empty SecurityIdentity #10532

Closed
sberyozkin opened this issue Jul 7, 2020 · 1 comment · Fixed by #10542
Closed

HTTP 'authenticated' policy returns HTTP 200 for empty SecurityIdentity #10532

sberyozkin opened this issue Jul 7, 2020 · 1 comment · Fixed by #10542
Labels
area/security kind/bug Something isn't working
Milestone
1.7.0.CR1

Comments

@sberyozkin
Copy link
Member

Describe the bug
This is detected by @Sgitario.

The following configuration results in HTTP 200 and the empty body being returned:

quarkus.http.auth.permission.1.paths=/*
quarkus.http.auth.permission.1.policy=authenticated
quarkus.oidc.enabled=true
quarkus.oidc.tenant-enabled=false

where quarkus-oidc returns an empty Uni SecurityIdentity and Challenge items.

Expected behavior
401 is returned since SecurityIdentity is not available.
@sberyozkin sberyozkin added kind/bug Something isn't working area/security labels Jul 7, 2020
@sberyozkin
Copy link
Member Author

Hi @stuartwdouglas Do you agree ?

@sberyozkin sberyozkin mentioned this issue Jul 7, 2020
Closed
stuartwdouglas added a commit to stuartwdouglas/quarkus that referenced this issue Jul 8, 2020
@stuartwdouglas
If no challenge is generated return 401
76f4a6c 
Fixes quarkusio#10532
@stuartwdouglas stuartwdouglas mentioned this issue Jul 8, 2020
Merged
@sberyozkin sberyozkin added this to the 1.7.0 - master milestone Jul 8, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
area/security kind/bug Something isn't working
Projects
None yet
Milestone
1.7.0.CR1
Development

Successfully merging a pull request may close this issue.

If no challenge is generated return 401 stuartwdouglas/quarkus
1 participant
@sberyozkin