ContextNotActiveException Issue in ResteasyReactiveClientResponseFilter when using @ActivateRequestContext and OidcClientRequestReactiveFilter

[npoirey]

Describe the bug

Hi,

This one is weird and I gave up trying to find the root cause.
I made a small project that reproduces the issue here : https://github.com/npoirey/quarkus-repro-oidc-requestcontextnotactive

Basically, I have the following :

• a RequestScoped bean (RequestContextBean), that I use to propagate some context for logging purpose mainly
• a kafka consumer (TotoConsumer in the repo) annotated with @Blocking, and @ActivateRequestContext in order to use my RequestScopedBean
• 2 HTTP clients, both identical and having a logging filter (ClientLoggingFilter), but one of them also has the provider OidcClientRequestReactiveFilter

the idea is

• consume data
• init RequestScopedBean from data
• call some API
• have the request/response logged (system.out in my example)
• ack the message

If I use the HTTP client WITHOUT OIDC, everything works fine.
You can see it by running the test RequestContextBeanPropagationTest.testConsumesWithoutOidc() :

(don't pay attention to the 404, I didn't bother mocking the server)
In this test, I get traces from my filter

However, it doesnt work when using OIDC
You can see it by running the test RequestContextBeanPropagationTest.testConsumesWithOidc() :

in this test, I dont get the logs from my filter. Instead it throws a javax.enterprise.context.ContextNotActiveException: RequestScoped context was not active when trying to obtain a bean instance for a client proxy of CLASS bean [class=org.acme.security.openid.connect.client.RequestContextBean, id=e4da94214e7ddc6f068456b5228496f1268add1a]

As a workaround, I added @ActivateRequestContext annotation on the filter itself, but obviously this only solves the exception - I still don't have the correct bean/context so my log is incomplete

As I had trouble understanding where the issue comes from, please let me know if I should create this issue on another project.

Thank you

Expected behavior

The requestContext should be active in ResteasyReactiveClientResponseFilter, even if it was activated manually beforehand via @ActivateRequestContext and the client is using OIDC.

In my example, RequestContextBeanPropagationTest.testConsumesWithOidc() should have the same output than RequestContextBeanPropagationTest.testConsumesWithoutOidc()

Actual behavior

throws a javax.enterprise.context.ContextNotActiveException: RequestScoped context was not active when trying to obtain a bean instance for a client proxy of CLASS bean [class=org.acme.security.openid.connect.client.RequestContextBean, id=e4da94214e7ddc6f068456b5228496f1268add1a]

How to Reproduce?

pull this repo
run RequestContextBeanPropagationTest.testConsumesWithOidc()

Output of uname -a or ver

No response

Output of java -version

No response

GraalVM version (if different from Java)

No response

Quarkus version or git rev

No response

Build tool (ie. output of mvnw --version or gradlew --version)

No response

Additional information

No response

[quarkus-bot]

/cc @pedroigor(oidc), @sberyozkin(oidc)

[sberyozkin]

Hi @mkouba @manovotn @geoand, If you can spot what might be causing it in the reproducer, then please let me know, I agree with @npoirey it is a bit tricky to isolate the problem :-).
As far as the reproducer is concerned,
https://github.com/npoirey/quarkus-repro-oidc-requestcontextnotactive/blob/master/src/main/java/org/acme/security/openid/connect/client/ClientLoggingFilter.java#L15
https://github.com/npoirey/quarkus-repro-oidc-requestcontextnotactive/blob/master/src/main/java/org/acme/security/openid/connect/client/RestClientWithOidcClientFilter.java
https://github.com/npoirey/quarkus-repro-oidc-requestcontextnotactive/blob/master/src/main/java/org/acme/security/openid/connect/client/TotoConsumer.java

are likely most relevant, there is a mix of @request scoped beans such as https://github.com/npoirey/quarkus-repro-oidc-requestcontextnotactive/blob/master/src/main/java/org/acme/security/openid/connect/client/RequestContextBean.java

@ActivateRequestMethod: https://github.com/npoirey/quarkus-repro-oidc-requestcontextnotactive/blob/master/src/main/java/org/acme/security/openid/connect/client/RequestContextBean.java

and what seems to be affecting the setup, https://github.com/quarkusio/quarkus/blob/main/extensions/oidc-client-reactive-filter/runtime/src/main/java/io/quarkus/oidc/client/reactive/filter/OidcClientRequestReactiveFilter.java. I've looked through all of this source and I did not see any @RequestScoped, it is implicit I believe

[geoand]

I am not really sure how this could happen, so I would like to hear from @mkouba

[mkouba]

I think that we'll need someone with Reactive Messaging experience. In this particular case, a reactive client (implemented by quarkus-rest-client-reactive) is called from within a processor method.

CC @ozangunalp @cescoffier

Also #21367 (comment) and #27802 might be related.

FTR I've tried to disable SmallRye Context Propagation for CDI contexts completely via quarkus.arc.context-propagation.enabled=false and both test methods fail consistently with ContextNotActiveException. Which indicates that the vertx duplicated context created by the Reactive Messaging per the processor invocation is not used in the ClientLoggingFilter.

[ozangunalp]

I see that the request context is suspended during token retrieval in https://github.com/quarkusio/quarkus/blob/main/extensions/oidc-client-reactive-filter/runtime/src/main/java/io/quarkus/oidc/client/reactive/filter/runtime/AbstractOidcClientRequestReactiveFilter.java#L30

[sberyozkin]

Indeed, it is a typical idea AFAIK in RestEasy reactive filters as otherwise it would have to block until the token is retrieved

[mkouba]

I see that the request context is suspended during token retrieval in

Yes, but that's not the CDI request context but resteasy-reactive request context. @geoand Could it be related?

[geoand]

Likely, but I don't really know where to look

[ozangunalp]

I don't think the rest client supports propagating the CDI request scope:

quarkus/independent-projects/resteasy-reactive/client/runtime/src/main/java/org/jboss/resteasy/reactive/client/impl/RestClientRequestContext.java

Line 535 in 3534e9d

protected boolean isRequestScopeManagementRequired() {

It is debatable but I think it makes sense. The request scope is for incoming server requests, an outgoing REST client request doesn't require the CDI Request scope.

[sberyozkin]

an outgoing REST client request doesn't require the CDI Request scope.

FYI, OIDC token propagation reactive client filter (though it is not used in this reproducer) has a current request token injected

[ozangunalp]

FYI, OIDC token propagation reactive client filter (though it is not used in this reproducer) has a current request token injected

I see that now, HeaderContainer is also provided as request-scoped.
But suppose somehow the rest client is called without a request context, or the request context gets deactivated as in the case of OidcClientRequestReactiveFilter. In that case, it won't be reactivated during handler calls.

[geoand]

Ideally we would have the rest client keep the request scope when it's executed as part of an active request, but I am not sure how possible that will be...