Improve the OIDC/OAuth2 documentation #10653
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
I've tried to interlink all the OIDC/OAuth2 docs, clarify a few things, also added a section about the roles, etc |
sberyozkin
force-pushed
the
oidc_roles_docs
branch
from
53b6dfd to
ab4acac
Compare
loicmathieu
reviewed
Jul 13, 2020
| This guide explains how your Quarkus application can utilize MicroProfile Json Web Token (link:https://jwt.io/[JWT]) | ||
| Role-Based Access Control (link:https://en.wikipedia.org/wiki/Role-based_access_control[RBAC]) to provide | ||
| secured access to the JAX-RS endpoints. | ||
| This guide explains how your Quarkus application can utilize MicroProfile JWT (MP JWT) to verify https://tools.ietf.org/html/rfc7519[JSON Web Token]s, represent them as MP JWT `JsonWebToken` and provide secured access to the JAX-RS endpoints using Bearer Token Authorization and https://en.wikipedia.org/wiki/Role-based_access_control[Role-Based Access Control]. |
There was a problem hiding this comment.
represent them as MP JWT
JsonWebToken
Maybe give the fully qualified class name istead: represent them as org.microprofile.i-don't-know-which-package.JsonWebToken`.
Also, security is not only for JAX-RS endpoint right ? It also works for Sevlet and reactive route.
There was a problem hiding this comment.
@loicmathieu thanks for the comments, sure I'll just say Quarkus HTTP endpoints
|
|
||
| This guide demonstrates how to use the OpenID Connect Extension to protect your application using Quarkus, where authentication and authorization are based on tokens issued by OpenId Connect and OAuth 2.0 compliant Authorization Servers such as https://www.keycloak.org/about.html[Keycloak]. | ||
| This guide demonstrates how to use Quarkus OpenID Connect Extension to protect your JAX-RS applications using OpenId Connect Authorization Code Flow supported by OpenId Connect compliant Authorization Servers such as https://www.keycloak.org/about.html[Keycloak]. |
There was a problem hiding this comment.
Same here, it's not only JAX-RS that you can protect
|
|
||
| == Token Claims And SecurityIdentity Roles | ||
|
|
||
| The way the roles are mapped to the SecurityIdentity roles from the verified tokens is identical to how it is done for the link:security-openid-connect#token-claims-and-securityidentity-roles[bearer tokens] with the only difference being is that ID JWT token is used as a source of the roles by default. |
There was a problem hiding this comment.
It's not clear for my what ID JWT token is ?
There was a problem hiding this comment.
@loicmathieu I'll change it to just ID token, it is returned, alongside access token, as part of the OIDC code flow, https://openid.net/specs/openid-connect-core-1_0.html#TokenResponse
I agree, let's keep the oauth2 extension for opaque token only, even if it can of validate a JWT token, we should keep the documentation as simple as possible and document the best way to do things. |
pedroigor
reviewed
Jul 13, 2020
sberyozkin
force-pushed
the
oidc_roles_docs
branch
from
ab4acac to
dfdcad9
Compare
pedroigor
approved these changes
Jul 13, 2020
|
@loicmathieu @pedroigor Thanks, I'll be following up with more updates around the security and OIDC docs, cheers |
|
@sberyozkin This seems to have broken the documentation module in I can reproduce this locally and once I do |
|
I can confirm that by reverting commit dfdcad9 the build works again |
|
Yup, saw this in one of my PRs as well |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #10363
Fixes #10587