diff --git a/docs/src/main/asciidoc/security-oidc-code-flow-authentication.adoc b/docs/src/main/asciidoc/security-oidc-code-flow-authentication.adoc index 15ecefed83af42..3fb6ade6c8ffb8 100644 --- a/docs/src/main/asciidoc/security-oidc-code-flow-authentication.adoc +++ b/docs/src/main/asciidoc/security-oidc-code-flow-authentication.adoc @@ -133,6 +133,8 @@ quarkus.oidc.client-id=quarkus-app # This is a key which will be used to retrieve a secret from the map of credentials returned from CredentialsProvider quarkus.oidc.credentials.client-secret.provider.key=mysecret-key +# this is the keyring provided to the CredentialsProvider when looking up the secret, set only if required by the CredentialsProvider implementation +quarkus.oidc.credentials.client-secret.provider.keyring-name=oidc # Set it only if more than one CredentialsProvider can be registered quarkus.oidc.credentials.client-secret.provider.name=oidc-credentials-provider ---- @@ -165,6 +167,8 @@ quarkus.oidc.client-id=quarkus-app # This is a key which will be used to retrieve a secret from the map of credentials returned from CredentialsProvider quarkus.oidc.credentials.jwt.secret-provider.key=mysecret-key +# this is the keyring provided to the CredentialsProvider when looking up the secret, set only if required by the CredentialsProvider implementation +quarkus.oidc.credentials.client-secret.provider.keyring-name=oidc # Set it only if more than one CredentialsProvider can be registered quarkus.oidc.credentials.jwt.secret-provider.name=oidc-credentials-provider ---- diff --git a/docs/src/main/asciidoc/security-openid-connect-client-reference.adoc b/docs/src/main/asciidoc/security-openid-connect-client-reference.adoc index 6bceac124346ab..d388172f41ba2c 100644 --- a/docs/src/main/asciidoc/security-openid-connect-client-reference.adoc +++ b/docs/src/main/asciidoc/security-openid-connect-client-reference.adoc @@ -725,6 +725,8 @@ quarkus.oidc-client.client-id=quarkus-app # This key is used to retrieve a secret from the map of credentials returned from CredentialsProvider quarkus.oidc-client.credentials.client-secret.provider.key=mysecret-key +# this is the keyring provided to the CredentialsProvider when looking up the secret, set only if required by the CredentialsProvider implementation +quarkus.oidc.credentials.client-secret.provider.keyring-name=oidc # Set it only if more than one CredentialsProvider can be registered quarkus.oidc-client.credentials.client-secret.provider.name=oidc-credentials-provider ---- @@ -757,6 +759,8 @@ quarkus.oidc-client.client-id=quarkus-app # This is a key that will be used to retrieve a secret from the map of credentials returned from CredentialsProvider quarkus.oidc-client.credentials.jwt.secret-provider.key=mysecret-key +# this is the keyring provided to the CredentialsProvider when looking up the secret, set only if required by the CredentialsProvider implementation +quarkus.oidc.credentials.client-secret.provider.keyring-name=oidc # Set it only if more than one CredentialsProvider can be registered quarkus.oidc-client.credentials.jwt.secret-provider.name=oidc-credentials-provider ---- diff --git a/extensions/oidc-client/deployment/src/test/resources/application-oidc-client-credentials.properties b/extensions/oidc-client/deployment/src/test/resources/application-oidc-client-credentials.properties index fa819fb5570e1b..15d8fef4f398c3 100644 --- a/extensions/oidc-client/deployment/src/test/resources/application-oidc-client-credentials.properties +++ b/extensions/oidc-client/deployment/src/test/resources/application-oidc-client-credentials.properties @@ -5,4 +5,5 @@ quarkus.oidc.credentials.secret=secret quarkus.oidc-client.auth-server-url=${quarkus.oidc.auth-server-url} quarkus.oidc-client.client-id=${quarkus.oidc.client-id} quarkus.oidc-client.credentials.client-secret.provider.name=vault-secret-provider +quarkus.oidc-client.credentials.client-secret.provider.keyring-name=oidc quarkus.oidc-client.credentials.client-secret.provider.key=secret-from-vault \ No newline at end of file diff --git a/extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonConfig.java b/extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonConfig.java index 3bd6aef0eac404..bac0da97a23d53 100644 --- a/extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonConfig.java +++ b/extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonConfig.java @@ -467,12 +467,22 @@ public void setAssertion(boolean assertion) { public static class Provider { /** - * The CredentialsProvider name, which should only be set if more than one CredentialsProvider is + * The CredentialsProvider bean name, which should only be set if more than one CredentialsProvider is * registered */ @ConfigItem public Optional name = Optional.empty(); + /** + * The CredentialsProvider keyring name, which should always be set when using a CredentialsProvider + * to provide a secret key to this extension. The keyring name is only required when the CredentialsProvider being + * used requires the keyring name to look up the secret, which is often the case when a CredentialsProvider is + * shared by multiple extensions to retrieve credentials from a more dynamic source like a vault instance or secret + * manager + */ + @ConfigItem + public Optional keyringName = Optional.empty(); + /** * The CredentialsProvider client secret key */ @@ -487,6 +497,14 @@ public void setName(String name) { this.name = Optional.of(name); } + public Optional getKeyringName() { + return keyringName; + } + + public void setKeyringName(String keyringName) { + this.keyringName = Optional.of(keyringName); + } + public Optional getKey() { return key; } diff --git a/extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java b/extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java index 573136997bd8ec..eb6d4df5c5f039 100644 --- a/extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java +++ b/extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java @@ -319,10 +319,9 @@ private static Supplier fromCredentialsProvider(Provider provi public String get() { if (provider.key.isPresent()) { String providerName = provider.name.orElse(null); + String keyringName = provider.keyringName.orElse(null); CredentialsProvider credentialsProvider = CredentialsProviderFinder.find(providerName); - if (credentialsProvider != null) { - return credentialsProvider.getCredentials(providerName).get(provider.key.get()); - } + return credentialsProvider.getCredentials(keyringName).get(provider.key.get()); } return null; } diff --git a/extensions/oidc/deployment/src/test/java/io/quarkus/oidc/test/SecretProvider.java b/extensions/oidc/deployment/src/test/java/io/quarkus/oidc/test/SecretProvider.java index 54c04f4eb32f32..88446d8465c53e 100644 --- a/extensions/oidc/deployment/src/test/java/io/quarkus/oidc/test/SecretProvider.java +++ b/extensions/oidc/deployment/src/test/java/io/quarkus/oidc/test/SecretProvider.java @@ -14,7 +14,11 @@ public class SecretProvider implements CredentialsProvider { @Override public Map getCredentials(String credentialsProviderName) { - return Collections.singletonMap("secret-from-vault", "secret"); + if ("oidc".equals(credentialsProviderName)) { + return Collections.singletonMap("secret-from-vault", "secret"); + } else { + return Map.of(); + } } } diff --git a/extensions/oidc/deployment/src/test/resources/application-dev-mode.properties b/extensions/oidc/deployment/src/test/resources/application-dev-mode.properties index faf2273824d87b..6404454372c64d 100644 --- a/extensions/oidc/deployment/src/test/resources/application-dev-mode.properties +++ b/extensions/oidc/deployment/src/test/resources/application-dev-mode.properties @@ -2,6 +2,7 @@ quarkus.oidc.auth-server-url=${keycloak.url}/realms/quarkus quarkus.oidc.tenant-enabled=false quarkus.oidc.client-id=${oidc.client-id} quarkus.oidc.credentials.client-secret.provider.name=vault-secret-provider +quarkus.oidc.credentials.client-secret.provider.keyring-name=oidc # This is a wrong client secret key, will be updated to 'secret-from-vault' in the dev mode test quarkus.oidc.credentials.client-secret.provider.key=secret-from-vault-typo quarkus.oidc.application-type=web-app