Support basic, mTLS and bearer access token based auth and authorization using annotations when running on Vert.x gRPC server #37966
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
belongs to the #24755 (it deals with gRPC service implementation, consumption will be next step after this PR)
Some users try to leverage the fact that HTTP authenticator and authorizer runs before gRPC route (when
quarkus.grpc.server.use-separate-server=false
) but this approach had before this PR few flaws:SecurityIdentity
used for authentication / authorization inside gRPC service, hence you don't know anything about the userSecurityIdentity
or use RBAC annotations, their only option is to implementGrpcSecurityMechanism
This PR makes very small change which fixes above-mentioned points - use Quarkus HTTP Security Identity and make it available for RBAC authorization and
SecurityIdentity
injection. It also adds bunch of tests for basic auth, mTLS roles mapping (also existing tests didn't actually usedX509IdentityProvider
and mTLS auth mechanism, they authenticate on lower level), OIDC Bearer token auth, SmallRye JWT and OAuth2.