-
Notifications
You must be signed in to change notification settings - Fork 2.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update OIDC client filters to check if OIDC client feature is enabled #43374
Update OIDC client filters to check if OIDC client feature is enabled #43374
Conversation
🎊 PR Preview 14af184 has been successfully built and deployed to https://quarkus-pr-main-43374-preview.surge.sh/version/main/guides/
|
2cae379
to
5c93205
Compare
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Changes LGTM.
...ime/src/main/java/io/quarkus/oidc/client/filter/runtime/AbstractOidcClientRequestFilter.java
Outdated
Show resolved
Hide resolved
.../io/quarkus/oidc/client/reactive/filter/runtime/AbstractOidcClientRequestReactiveFilter.java
Outdated
Show resolved
Hide resolved
5c93205
to
6092c24
Compare
@michalvavrik I've tried to make related log messages more informative as you suggested, have a look please |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
In my eyes that's better, thank you
Status for workflow
|
Status for workflow
|
Fixes #41827.
When the OIDC client filter is registered with the
@OidcClient
annotation, disabling the OIDC client feature withquarkus.oidc-client.enabled=false
makes@OidcClient
ineffective because it is processed at the OIDC client filter build time and is preconditioned on the underlying OIDC client feature being enabled.However, when the OIDC client filter is registered directly using a
@RegisterRestClient
annotation, the fact that the OIDC client feature is disabled withquarkus.oidc-client.enabled=false
is not relevant, it is just a standard, generic JAX-RS provider registration. Then, when the request is made, the filter tries to do something with the disabled client and the request fails.This PR attempts to fix it by updating OIDC client filters to check the build time
quarkus.oidc-client.enabled
property and avoid any OidcClient related initialization or processing if it is disabled.The test has been updated. Specifically, when the OIDC client is disabled, the test gets
401
when a securedProtectedResource
method is called because it does not get an expected token. But it gets an empty response when a public method in theProtectedResource
is called, proving no token is arriving, with the OidcClient filter not impacting the request flow, even though the OidcClient is disabled.When the OidcClient is enabled, the public method returns a user name, similarly to when a secured method is called, due to the proactive authentication, proving the token is flowing in this case as well