Make it possible to switch off Authentication on the dev environment easily

[MarcusBiel]

In Micronaut, using the @requires annotation, you can define that a mocked security filter is only active when a disable flag
is set to true - this way Authentication can be active on PROD by default, but you can deactivate it on DEV to simplify testing:

@Singleton
@Requires(property = "application.disable-authentication", value = "true", defaultValue = "false")
public AuthenticationFetcher mockAuthFetcher() {
    return new MockAuthFetcher(new MyAuthentication("MOCK_TOKEN", "MOCK_USER", Set.of(
        "User",
        "Admin"
        )));

--
Would love to see something similar in Quarkus.

[sberyozkin]

Is this MockAuthFetcher shipped with the main code given the default property value is false ?

[MarcusBiel]

Yes, shipped with the main code, but default false means Mocked authentication is disabled by default, so when the property setting is missing, Authentication will be on by default.

[sberyozkin]

@MarcusBiel thanks.
Ok, as discussed in the forum, we have 2 somewhat more involved but quite functional mechanisms where no live OIDC provider connection is required, 1) use the local verification key 2) use the local test OIDC JAX-RS endpoint.
Every part of the authentication flow is customizable but looks like we don't have an option where we have for example quarkus-oidc enabled but have its identity provider mocked.
The idea above is interesting, however I'm not sure shipping the mock code with the main source will work for Quarkus.
Lets see what Stuart @stuartwdouglas says :-)
Thanks

[stuartwdouglas]

For HTTP you should be able to include a HttpAuthenticationMechanism (with a CDI scope) in src/test/java and this will be used by the tests to authenticate. If you just make this return a mock user then you can get the same result.

[stuartwdouglas]

We could also add some kind of simple way to do this automatically, like an @testuser annotation that controls the user the test runs under.

[sberyozkin]

@stuartwdouglas and may be @testroles...

[stuartwdouglas]

That would just be part of the user annotation

[sberyozkin]

#10487 fixes this issue (thanks to Stuart).
@MarcusBiel FYI, I'm going to close the issue, but please reopen if you feel the fix does not address your enhancement request.
Thanks