Disable OidcClientFilter at runtime for simpler application testing

[lmartella1]

Hello,
in our Quarkus application we rely on the OidcClientFilter to instrument Quarkus in acquiring a token before calling a given REST Client.
In certain cases, such as when we run quarkus tests or we deploy the application in a local environment, we believe it could be useful to disable the OidcClientFilter in a way that the token is not acquired and the client call is made to the remote (in many cases mocked) server without any bearer token. In all these cases, is more relevant to test the application business logic than the actual token acquisition and security aspects.

Looking at the current available configuration for the oidc-client, I don't see any runtime-overridable configuration that can serve this scope and instrument Quarkus to just ignore the OidcClientFilter annotation either globally, for all the oidc clients, or specifically for a given named oidc client.

What is your vision about this use case? Is it a feature that could be implemented in a future version of the framework?

For reference, we have already played with :

• quarkus.oidc-client.enabled=false which works globally in disabling the token acquisition for all the annotated OidcClientFilter REST Clients but which is fixed at build time and cannot be overridden at runtime.
• quarkus.oidc-client."id".client-enabled=false which is disabling a given oidc-client configuration in a way that, if the client is used then the following runtime exception is raised: io.quarkus.oidc.client.runtime.DisabledOidcClientException.

Thanks in advance,

[quarkus-bot[bot]]

/cc @pedroigor (oidc), @sberyozkin (oidc)

[sberyozkin]

Hi @lmartella1

I think the fact that OidcClientFilter throws an exception when the client is disabled at runtime is a bug, it should log the debug message and just return return

[sberyozkin]

@lmartella1
https://github.com/quarkusio/quarkus/blob/main/extensions/oidc-client-filter/runtime/src/main/java/io/quarkus/oidc/client/filter/runtime/AbstractOidcClientRequestFilter.java#L29 should just return
and
https://github.com/quarkusio/quarkus/blob/main/extensions/oidc-client-reactive-filter/runtime/src/main/java/io/quarkus/oidc/client/reactive/filter/runtime/AbstractOidcClientRequestReactiveFilter.java#L42 should return too after requestContext.resume()

If you'd like please open a simple PR, I can have look but it will be in a few days or so

[sberyozkin]

@lmartella1 It has been fixed

[lmartella1]

Great! Thank you very much!

[sahil24sharma]

@sberyozkin I don't see it fixed. What dependency I need to add to see the changes. I added `implementation 'io.quarkus:quarkus-oidc-client-reactive-filter:3.7.1'.

[sberyozkin]

@sahil24sharma It was fixed with this PR, https://github.com/quarkusio/quarkus/pull/37361/files, DisabledOidcClientException is now not blocking the filter flow. What is happening in your case ?

[sahil24sharma]

@sberyozkin in my _AbstractOidcClientRequestReactiveFilter_ i can see which is aborting my test.

 if (t instanceof DisabledOidcClientException) {
                    LOG.debug("Client is disabled");
                    requestContext.abortWith(Response.status(Response.Status.INTERNAL_SERVER_ERROR).build());
                }

[sberyozkin]

@sahil24sharma Looks like you are picking up the old code, on 3.7.1 it is not aborting the request: https://github.com/quarkusio/quarkus/blob/3.7.1/extensions/oidc-client-reactive-filter/runtime/src/main/java/io/quarkus/oidc/client/reactive/filter/runtime/AbstractOidcClientRequestReactiveFilter.java#L41