Allow to set OIDC tenant using annotations

[j-be]

Description

Lets assume one has a big API in a single Quarkus service (i.e. quarkus.oidc.application-type=service), but different APIs are for a different group of people. Like: this JAX-RS annotated class provides endpoints solely for HR, this other class solely for finances, this class is solely for engineering, and so on.

Now, usually one would solve that using roles, but a problem arises when those groups of people are authenticated by different OIDC providers.

We can still leverage OIDC multi-tenancy to solve the issue, but TenantResolver.resolve(RoutingContext) offers very little information (apart from the raw request path/URL) to base the decision on.

In such scenarios it would be really nice to be able to specify the tenant using annotations, like:

@TenantId("hr")
@RolesAllowed("admin")
@GET @Path("/")
public String getSomething() {
    return "something";
}

Implementation ideas

As proposed by @mkouba on Zulip one could leverage an @Interceptor to manipulate RoutingContext and use that in TenantResolver, like:

@Inherited
@InterceptorBinding
@Retention(RetentionPolicy.RUNTIME)
@Target({ElementType.METHOD, ElementType.TYPE})
public @interface HrTenant {
}

@Interceptor
@HrTenant
public class HrTenantInterceptor {
    @Inject
    RoutingContext routingContext;

    @AroundInvoke
    Object setTenant(InvocationContext context) throws Exception {
        routingContext.put(OidcUtils.TENANT_ID_ATTRIBUTE, "hr");
        return context.proceed();
    }
}

@ApplicationScoped
public class OidcTenantResolver implements TenantResolver {
    @Override
    public String resolve(RoutingContext context) {
        return context.get(OidcUtils.TENANT_ID_ATTRIBUTE);
    }
}

As @sberyozkin pointed out: by patching DefaultTenantResolver to check for the value we should even be able to avoid a dedictated TenantResolver.

With a bit more effort it should also be able to implement a parameterized version of the annotation, like:

@Inherited
@InterceptorBinding
@Retention(RetentionPolicy.RUNTIME)
@Target({ElementType.METHOD, ElementType.TYPE})
public @interface TenantId {
  @NonBinding String value();
}

The code providing support for @CacheInvalidateAll with its cacheName parameter should be exactly the same as we'd need here. But I think that is not worth posting here.

[quarkus-bot]

/cc @pedroigor, @sberyozkin

[sberyozkin]

@j-be I think your approach is the simplest; with Cache interceptors, since the annotation value is non-binding, they iterate over all the matching annotations. The custom interceptor you have typed is straightforward, so for now I believe we should just tweak quarkus-oidc a bit and doc how to write such an interrceptor

[j-be]

@sberyozkin Sounds good to me. If you point me to how and where I can do the documentation update - I'm more than happy to provide a rough draft. Same goes for DefaultTenantResolver - I can't seem to find any such class for OIDC tenants. https://quarkus.io/guides/security-openid-connect-multitenancy#writing-the-application only seems to suggest that there is one for HibernateORM.

[sberyozkin]

@j-be Sorry, I mistyped, it is an internal DefaultTenantConfigResolver. I believe

String tenantId = null;

        if (tenantResolver.isResolvable()) {
            tenantId = context.get(CURRENT_STATIC_TENANT_ID);
            if (tenantId == null && context.get(CURRENT_STATIC_TENANT_ID_NULL) == null) {
                tenantId = tenantResolver.get().resolve(context);
                if (tenantId != null) {
                    context.put(CURRENT_STATIC_TENANT_ID, tenantId);
                } else {
                    context.put(CURRENT_STATIC_TENANT_ID_NULL, true);
                }
            }
        }

can be optimized/replaced with

String tenantId = context.get(CURRENT_STATIC_TENANT_ID);
 if (tenantId == null && context.get(CURRENT_STATIC_TENANT_ID_NULL) == null) {
       if (tenantResolver.isResolvable()) {
                tenantId = tenantResolver.get().resolve(context);
       } else {
                tenantId = context.get(OidcUtils.TENANT_ID_ATTRIBUTE);
       }
}

if (tenantId != null) {
                    context.put(CURRENT_STATIC_TENANT_ID, tenantId);
                } else {
                    context.put(CURRENT_STATIC_TENANT_ID_NULL, true);
                }

Looks like the oidc-multi-tenancy guide needs to be refactored a bit - I can look into it later on. But for now I'd suggest to add a new subsection, just above https://quarkus.io/guides/security-openid-connect-multitenancy#programmatically-resolving-tenants-configuration, say Resolving Tenant Identifiers with Annotations where we can start with something like You can use the annotations and CDI interceptors for resolving the tenant identifiers as an alternative to using quarkus.oidc.TenantResolver, for example:, with your examples, something like that ?

If you can create a PR then it would be appreciated

[j-be]

If you can create a PR then it would be appreciated

Sure thing, always happy to help 😃

[sberyozkin]

@j-be Thanks

[Eng-Fouad]

Related #34692