OIDC adapter stabilization

[sberyozkin]

Description

Users are actively experimenting with the OIDC adapter and have reported a number of bugs.

Analysis

A complete list of the OIDC issues.

Tasks

• OIDC web-app applications do not work with IdentityServer 4 (Support application/jwk-set+json content type when processing responses from JWKS Endpoint #6087, depends on Update to Vertx 3.8.5 #6526)
• OIDC web-app applications do not work with Okta (Sending clientId/clientSecret as form params during a code flow does not work with Okta #5277, depends on Update to Vertx 3.8.5 #6526)
• OIDC web-app applications do not work with Microsoft ADFS (OpenID Connect code flow problem with Microsoft Active Directory Federation Services (ADFS) #6603, depends on Update to Vertx 3.8.5 #6526)
• quarkus-keycloak-authorization does not work with reactive routes (Keycloak with Reactive Routes Error: Request has already been read #5809)
• integration-tests/oidc-code-flow test is unstable (OIDC integration-tests/oidc-code-flow is unstable #5926)
• OIDC web-app applications have to support a static redirect-url (OIDC Redirect URL should be static absolute URL #5733)
• OIDC web-app applications do not work with Auth0 (Quarkus OIDC does not work with Auth0 #5829)
• quarkus-keycloak-authorization does not work with Keycloak 8 (Add support for Keycloak 8 #5868)
• HTTP 403 should be reported if token has no expected custom role claim (quarkus-oidc throws an OIDCException when a token does not contain the role-claim-path #5750)
• quarkus-keycloak-authorization claim information point read body NPE (Keycloak Claim Information Point - NPE when trying to read body  #5959)

[paulrobinson]

@sberyozkin Are you the Epic lead for this? See here for an explanation of the role: https://github.com/quarkusio/quarkus/wiki/High-Level-Planning-Process#ive-been-assigned-an-epic-what-do-i-need-to-do.

If so, can you assign this issue to yourself? Thanks :-)

[sberyozkin]

@paulrobinson sorry, just got back from a trip home...

[sberyozkin]

I've removed KeycloakAdminClient does not work because it depends on RestEasy 3.x (#6350) from this Epic because it is technically not related to both quarkus-oidc and quarkus-keycloak-authorization