OIDC JWK refresh support #9891
OIDC JWK refresh support #9891
Conversation
extensions/oidc/runtime/src/main/java/io/quarkus/oidc/OidcTenantConfig.java
Outdated
Show resolved
Hide resolved
extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcUtils.java
Outdated
Show resolved
Hide resolved
| @@ -193,7 +193,8 @@ public SecurityIdentity apply(Throwable throwable) { | |||
| LOG.debug("State parameter can not be empty or multi-valued"); | |||
| return Uni.createFrom().failure(new AuthenticationCompletionException()); | |||
| } else if (!stateCookie.getValue().startsWith(values.get(0))) { | |||
| LOG.debug("State cookie does not match the state parameter"); | |||
| LOG.debugf("State cookie value '%s' does not match the state query parameter value '%s'", | |||
There was a problem hiding this comment.
I'm not sure if it is a good idea to log the state value considering it is used in OAuth2 to prevent CSRF.
There was a problem hiding this comment.
@pedroigor I just added it because the user was getting this error, but I suppose seeing 2 different uuids in the logs won't help the users to figure out why it happened :-). OK, let me revert it
| @@ -32,6 +35,31 @@ private OidcUtils() { | |||
|
|
|||
| } | |||
|
|
|||
| public static boolean isOpaqueToken(String token) { | |||
| return new StringTokenizer(token, ".").countTokens() != 3; | |||
There was a problem hiding this comment.
A minor comment. Right now we only support JWS, but JWE uses 5 tokens.
But I guess we would handle JWEs as opaque tokens considering that you would need an introspection call to check claims.
There was a problem hiding this comment.
@pedroigor Right, at the moment no local JWE decryption is possible, so they are technically opaque for Quarkus
Fixes #5003
Fixes #7286
This PR:
missingKeyHandlerVertx Auth 3.9.1 feature with a controlled refresh interval period (10 mins by default). Right now, if the rotation happens and the current token has no local JWK with a matchingkidto verify it then 2 requests will go to OIDC server, 1 JWK refresh from our handler and one fallback introspection request - this is not really a problem for now as it will happen only once in some long enough irregular rotation interval in a long running applicationOidcResourceserver endpoint to emulate KeycloakCC @pmlopes