Multitenancy OIDC permit tenant enumeration

[guitcastro]

Describe the bug

We have a multi tenant application which programmatically choose the tenant based in the URL path. However, unauthorized users are able to find out tenant names because if the OIDC server is down (not exists in this case) it return a 500 error messag. But if OIDC server exists it will return a 401.

Expected behavior

To avoid tenant enumeration both requests should return the same status code (401 or 404).

Actual behavior

The framework return 500 if server is down (or not exits)

How to Reproduce?

1. Create a project with OIDC and Keycloak as dev service.
2. Configure a multi tenant architecture to resolve tenant in URL path.
3. Try to access a nonexistence tenant with any credentials, it will return 500
4. Try to access a existence tenant with any credentials, it will return 401

Output of uname -a or ver

No response

Output of java -version

No response

GraalVM version (if different from Java)

No response

Quarkus version or git rev

No response

Build tool (ie. output of mvnw --version or gradlew --version)

No response

Additional information

I tried to workaround the issue by using exception mapper but it not worked. (Method was not called)

[quarkus-bot]

/cc @pedroigor (oidc), @sberyozkin (oidc)

[sberyozkin]

Hi @guitcastro I'm not sure there is any tenant info leak here, it is just a URL, the notion of a tenant, i.e, what part of URL is relevant to the tenant resolution, is totally application specific, 500 will be returned for any unrecognized URL reaching OIDC and the response won't leak any internal details like the tenant config, however, indeed, right now, if the tenant can not be resolved, it will be 500, and I agree it makes sense to keep it consistent.

[sberyozkin]

@guitcastro Hey, I can't reproduce this failure. Do you have a default tenant disabled ? If your custom TenantConfigResolver returns null then the fallback is a default tenant (should be doc-ed in a few places). If the default tenant is not disabled but has no any configuration like the address url, etc, it is considered a server side error, 401 would be misleading in this context.
If you do not have it disabled, can you add quarkus.oidc.tenant-enabled=false - and you should get 401 as expected in this case.

[sberyozkin]

Never mind, I reproduced

[sberyozkin]

@guitcastro The immediate workaround/solution is to return Uni.createFrom().nullitem() instead of null.

[guitcastro]

@sberyozkin Sorry, I was not clear enough. I resolve the tenant dynamic using the url, and I don't have any way to know if the tenant exists or not.
I do understand that 500 is a valid response, however we need a way to handle it to return the desire status code for my application (401). So, the bug is really that I am not able to use Exception Mapper