OIDC code flow fails when Auth0 returns a binary access token #8396
Comments
majonga88
changed the title
|
@majonga88 Hi,
The debug message you are seeing seem to confirm that Auth0 returns an opaque token (not JWT) so Vertx asks Auth0 to introspect it. Try the above property please |
|
Hello, Thank you to reply me, I try this configuration : quarkus.oidc.auth-server-url=https://dev-0-77r6yl.auth0.com
quarkus.oidc.authentication.redirect-path=/
quarkus.oidc.application-type=web-app
quarkus.oidc.client-id=XXXX
quarkus.oidc.credentials.secret=XXXX
quarkus.oidc.authentication.scopes=read:contacts
quarkus.oidc.role-claim-path=scope
quarkus.http.auth.permission.authenticated.paths=/*
quarkus.http.auth.permission.authenticated.policy=authenticated
quarkus.log.level=DEBUGBut i have the same issue, the scope is not checked, and i have this error again : java.lang.RuntimeException: Not enough or too many segmentsIf you want to try my source feel free to ask the clientId and secrets. |
|
@majonga88 OK, the problem seems to do with the fact that |
sberyozkin
changed the title
|
@sberyozkin I will be patient :), if you want client-id and secret please contact me in pm, i really enjoy what you're doing guys ! Thank you ! |
|
@majonga88 Thanks; in meantime perhaps you can configure Auth0 to send JWT token instead ? According to this doc, Auth0 can return the binary token, and I've read somewhere else that it may return the binary tokens in all cases on the so called legacy pipelines. If you can make it return JWT it will work, I believe we've had the users confirming they could use Auth0 |
|
@sberyozkin Indeed, but you have to handle JWT generation inside your front end application here an example and i don't want to. I want to have authentification/authorization flow outside my applications (back and front). I know it's a step to unlock the problem, but i prefer wait a proper solution on your side. |
|
@majonga88 Can you please explain more what is happening ? We are looking at the Vertx code with @pmlopes and indeed when the binary access token is verified, the exception which you in the trace logs is thrown but the execution should still continue. |
|
It seems you have a logging bug on quarkus side, as you can see the level of those messages is |
|
@pmlopes The logging issue is really an orthogonal issue. The users may not even know what format the AT is in. The point is, in the code flow, we don't use it at all, we only use an ID token. From Auth0 docs (we did not use those docs as a foundation, but FYI as it is inline with what Quarkus does in the code flow): We may need to allow treating the access tokens as if they were intended for this client application (this Quarkus endpoint which runs the code flow) as I guess in some cases the borders between id and access tokens can be vague. But that is a separate issue. So @majonga88 can you please do the following: I'd like to see if the IdToken contains anything related to the permissions at all. Give it a try and let me know what you find, I'll then proceed with a fix as needed |
|
Hello @sberyozkin, I'm sorry to reply lately. I trying to get permissions with your code, but i don't have this information.
However, i set correctly in Auth0, the permission to my user like this :
With Big thank you to investigate in this. |
|
@majonga88 Np, thanks for a quick test. |
|
Ok thanks a lot. |
|
@majonga88 Hi, #10417 will resolve this issue. CC @pedroigor |
Hello guys,
I'm trying to securized one of my endpoints with scopes via Auth0 provider. The connection with Oauth provider working but i cannot able to put scope management into my api with quarkus.
I compare the js solution which is working and quarkus solution which i have an issue.
In JS sample provided by Auth0
Following this tutorial, the scopes are managed like this :
Source
In Quarkus sample i've made
Do you have a similar thing in Quarkus side ? Because i used this property
quarkus.oidc.authentication.scopesand it's not working, i don't have any check to forbidden the access if i removeread:contactsscope for example.Source
I have this error stack when i trying to connect to my api. Maybe is the cause of not working ?
Expected behavior
When i remove scope permission from Auth0 interface, forbidden access to my endpoint.
Actual behavior
The scope doesn't checked by the application.
Thanks a lot, for your help.
The text was updated successfully, but these errors were encountered: