This guide demonstrates how to use Quarkus OpenID Connect (OIDC) Extension to protect your JAX-RS applications using Bearer Token Authorization where Bearer Tokens are issued by OpenID Connect and OAuth 2.0 compliant Authorization Servers such as Keycloak.
Bearer Token Authorization is the process of authorizing HTTP requests based on the existence and validity of a Bearer Token which provides valuable information to determine the subject of the call as well as whether or not an HTTP resource can be accessed.
Please read the Using OpenID Connect to Protect Web Applications guide if you need to authenticate and authorize the users using OpenID Connect Authorization Code Flow.
If you use Keycloak and Bearer tokens then also see the Using Keycloak to Centralize Authorization guide.
Please read the Using OpenID Connect Multi-Tenancy guide how to support multiple tenants.
Quickstart
Prerequisites
To complete this guide, you need:
-
Roughly 15 minutes
-
An IDE
-
JDK 11+ installed with
JAVA_HOME
configured appropriately -
Apache Maven 3.8.4
-
A working container runtime (Docker or Podman)
-
Optionally the Quarkus CLI if you want to use it
-
Optionally Mandrel or GraalVM installed and configured appropriately if you want to build a native executable (or Docker if you use a native container build)
Architecture
In this example, we build a very simple microservice which offers two endpoints:
-
/api/users/me
-
/api/admin
These endpoints are protected and can only be accessed if a client is sending a bearer token along with the request, which must be valid (e.g.: signature, expiration and audience) and trusted by the microservice.
The bearer token is issued by a Keycloak Server and represents the subject to which the token was issued for. For being an OAuth 2.0 Authorization Server, the token also references the client acting on behalf of the user.
The /api/users/me
endpoint can be accessed by any user with a valid token. As a response, it returns a JSON document with details about the user where these details are obtained from the information carried on the token.
The /api/admin
endpoint is protected with RBAC (Role-Based Access Control) where only users granted with the admin
role can access. At this endpoint, we use the @RolesAllowed
annotation to declaratively enforce the access constraint.
Solution
We recommend that you follow the instructions in the next sections and create the application step by step. However, you can go right to the completed example.
Clone the Git repository: git clone https://github.com/quarkusio/quarkus-quickstarts.git
, or download an archive.
The solution is located in the security-openid-connect-quickstart
directory.
Creating the Maven Project
First, we need a new project. Create a new project with the following command:
This command generates a Maven project, importing the keycloak
extension
which is an implementation of a Keycloak Adapter for Quarkus applications and provides all the necessary capabilities to integrate with a Keycloak Server and perform bearer token authorization.
If you already have your Quarkus project configured, you can add the oidc
extension
to your project by running the following command in your project base directory:
quarkus extension add 'oidc'
./mvnw quarkus:add-extension -Dextensions="oidc"
./gradlew addExtension --extensions="oidc"
This will add the following to your build file:
<dependency>
<groupId>io.quarkus</groupId>
<artifactId>quarkus-oidc</artifactId>
</dependency>
implementation("io.quarkus:quarkus-oidc")
Writing the application
Let’s start by implementing the /api/users/me
endpoint. As you can see from the source code below it is just a regular JAX-RS resource:
package org.acme.security.openid.connect;
import javax.annotation.security.RolesAllowed;
import javax.inject.Inject;
import javax.ws.rs.GET;
import javax.ws.rs.Path;
import org.jboss.resteasy.annotations.cache.NoCache;
import io.quarkus.security.identity.SecurityIdentity;
@Path("/api/users")
public class UsersResource {
@Inject
SecurityIdentity securityIdentity;
@GET
@Path("/me")
@RolesAllowed("user")
@NoCache
public User me() {
return new User(securityIdentity);
}
public static class User {
private final String userName;
User(SecurityIdentity securityIdentity) {
this.userName = securityIdentity.getPrincipal().getName();
}
public String getUserName() {
return userName;
}
}
}
The source code for the /api/admin
endpoint is also very simple. The main difference here is that we are using a @RolesAllowed
annotation to make sure that only users granted with the admin
role can access the endpoint:
package org.acme.security.openid.connect;
import javax.annotation.security.RolesAllowed;
import javax.ws.rs.GET;
import javax.ws.rs.Path;
import javax.ws.rs.Produces;
import javax.ws.rs.core.MediaType;
@Path("/api/admin")
public class AdminResource {
@GET
@RolesAllowed("admin")
@Produces(MediaType.TEXT_PLAIN)
public String admin() {
return "granted";
}
}
Injection of the SecurityIdentity
is supported in both @RequestScoped
and @ApplicationScoped
contexts.
Configuring the application
The OpenID Connect extension allows you to define the adapter configuration using the application.properties
file which should be located at the src/main/resources
directory.
Example configuration:
%prod.quarkus.oidc.auth-server-url=http://localhost:8180/realms/quarkus
quarkus.oidc.client-id=backend-service
quarkus.oidc.client-secret=secret
# Tell Dev Services for Keycloak to import the realm file
# This property is not effective when running the application in JVM or Native modes
quarkus.keycloak.devservices.realm-path=quarkus-realm.json
Adding a %prod. profile prefix to quarkus.oidc.auth-server-url ensures that Dev Services for Keycloak will launch a container for you when the application is run in a dev mode. See Running the Application in Dev mode section below for more information.
|
Starting and Configuring the Keycloak Server
Do not start the Keycloak server when you run the application in a dev mode - Dev Services for Keycloak will launch a container. See Running the Application in Dev mode section below for more information.
|
To start a Keycloak Server you can use Docker and just run the following command:
docker run --name keycloak -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=admin -p 8180:8080 quay.io/keycloak/keycloak:{keycloak.version} start-dev
where keycloak.version
should be set to 17.0.0
or higher.
You should be able to access your Keycloak Server at localhost:8180.
Log in as the admin
user to access the Keycloak Administration Console. Username should be admin
and password admin
.
Import the realm configuration file to create a new realm. For more details, see the Keycloak documentation about how to create a new realm.
If you want to use the Keycloak Admin Client to configure your server from your application you need to include the
quarkus-keycloak-admin-client extension.
|
Running the Application in Dev mode
To run the application in a dev mode, use:
quarkus dev
./mvnw quarkus:dev
./gradlew --console=plain quarkusDev
Dev Services for Keycloak will launch a Keycloak container and import a quarkus-realm.json
.
Open a Dev UI available at /q/dev and click on a Provider: Keycloak
link in an OpenID Connect
Dev UI
card.
You will be asked to login into a Single Page Application
provided by OpenID Connect Dev UI
:
-
Login as
alice
(password:alice
) who has auser
role-
accessing
/api/admin
will return403
-
accessing
/api/users/me
will return200
-
-
Logout and login as
admin
(password:admin
) who has bothadmin
anduser
roles-
accessing
/api/admin
will return200
-
accessing
/api/users/me
will return200
-
Running the Application in JVM mode
When you’re done playing with the dev
mode" you can run it as a standard Java application.
First compile it:
quarkus build
./mvnw clean package
./gradlew build
Then run it:
java -jar target/quarkus-app/quarkus-run.jar
Running the Application in Native Mode
This same demo can be compiled into native code: no modifications required.
This implies that you no longer need to install a JVM on your production environment, as the runtime technology is included in the produced binary, and optimized to run with minimal resource overhead.
Compilation will take a bit longer, so this step is disabled by default;
let’s build again by enabling the native
profile:
quarkus build --native
./mvnw package -Dnative
./gradlew build -Dquarkus.package.type=native
After getting a cup of coffee, you’ll be able to run this binary directly:
./target/security-openid-connect-quickstart-runner
Testing the Application
See Running the Application in Dev mode section above about testing your application in a dev mode.
You can test the application launched in JVM or Native modes with curl
.
The application is using bearer token authorization and the first thing to do is obtain an access token from the Keycloak Server in order to access the application resources:
export access_token=$(\
curl --insecure -X POST http://localhost:8180/realms/quarkus/protocol/openid-connect/token \
--user backend-service:secret \
-H 'content-type: application/x-www-form-urlencoded' \
-d 'username=alice&password=alice&grant_type=password' | jq --raw-output '.access_token' \
)
The example above obtains an access token for user alice
.
Any user is allowed to access the
http://localhost:8080/api/users/me
endpoint
which basically returns a JSON payload with details about the user.
curl -v -X GET \
http://localhost:8080/api/users/me \
-H "Authorization: Bearer "$access_token
The http://localhost:8080/api/admin
endpoint can only be accessed by users with the admin
role. If you try to access this endpoint with the
previously issued access token, you should get a 403
response
from the server.
curl -v -X GET \
http://localhost:8080/api/admin \
-H "Authorization: Bearer "$access_token
In order to access the admin endpoint you should obtain a token for the admin
user:
export access_token=$(\
curl --insecure -X POST https://localhost:8543/realms/quarkus/protocol/openid-connect/token \
--user backend-service:secret \
-H 'content-type: application/x-www-form-urlencoded' \
-d 'username=admin&password=admin&grant_type=password' | jq --raw-output '.access_token' \
)
Please also see the Dev Services for Keycloak section below about writing the integration tests which depend on Dev Services for Keycloak
.
Reference Guide
Accessing JWT claims
If you need to access JWT token claims then you can inject JsonWebToken
:
package org.acme.security.openid.connect;
import org.eclipse.microprofile.jwt.JsonWebToken;
import javax.inject.Inject;
import javax.annotation.security.RolesAllowed;
import javax.ws.rs.GET;
import javax.ws.rs.Path;
import javax.ws.rs.Produces;
import javax.ws.rs.core.MediaType;
@Path("/api/admin")
public class AdminResource {
@Inject
JsonWebToken jwt;
@GET
@RolesAllowed("admin")
@Produces(MediaType.TEXT_PLAIN)
public String admin() {
return "Access for subject " + jwt.getSubject() + " is granted";
}
}
Injection of JsonWebToken
is supported in @ApplicationScoped
, @Singleton
and @RequestScoped
scopes however the use of @RequestScoped
is required if the individual claims are injected as simple types, please see Support Injection Scopes for JsonWebToken and Claims for more details.
User Info
Set quarkus.oidc.authentication.user-info-required=true
if a UserInfo JSON object from the OIDC userinfo endpoint has to be requested.
A request will be sent to the OpenID Provider UserInfo endpoint and an io.quarkus.oidc.UserInfo
(a simple javax.json.JsonObject
wrapper) object will be created.
io.quarkus.oidc.UserInfo
can be either injected or accessed as a SecurityIdentity userinfo
attribute.
Configuration Metadata
The current tenant’s discovered OpenID Connect Configuration Metadata is represented by io.quarkus.oidc.OidcConfigurationMetadata
and can be either injected or accessed as a SecurityIdentity
configuration-metadata
attribute.
The default tenant’s OidcConfigurationMetadata
is injected if the endpoint is public.
Token Claims And SecurityIdentity Roles
SecurityIdentity roles can be mapped from the verified JWT access tokens as follows:
-
If
quarkus.oidc.roles.role-claim-path
property is set and matching array or string claims are found then the roles are extracted from these claims. For example,customroles
,customroles/array
,scope
,"http://namespace-qualified-custom-claim"/roles
,"http://namespace-qualified-roles"
, etc. -
If
groups
claim is available then its value is used -
If
realm_access/roles
orresource_access/client_id/roles
(whereclient_id
is the value of thequarkus.oidc.client-id
property) claim is available then its value is used. This check supports the tokens issued by Keycloak
If the token is opaque (binary) then a scope
property from the remote token introspection response will be used.
If UserInfo is the source of the roles then set quarkus.oidc.authentication.user-info-required=true
and quarkus.oidc.roles.source=userinfo
, and if needed, quarkus.oidc.roles.role-claim-path
.
Additionally a custom SecurityIdentityAugmentor
can also be used to add the roles as documented here.
Token Verification And Introspection
If the token is a JWT token then, by default, it will be verified with a JsonWebKey
(JWK) key from a local JsonWebKeySet
retrieved from the OpenID Connect Provider’s JWK endpoint. The token’s key identifier kid
header value will be used to find the matching JWK key.
If no matching JWK
is available locally then JsonWebKeySet
will be refreshed by fetching the current key set from the JWK endpoint. The JsonWebKeySet
refresh can be repeated again only after the quarkus.oidc.token.forced-jwk-refresh-interval
(default is 10 minutes) expires.
If no matching JWK
is available after the refresh then the JWT token will be sent to the OpenID Connect Provider’s token introspection endpoint.
If the token is opaque (it can be a binary token or an encrypted JWT token) then it will always be sent to the OpenID Connect Provider’s token introspection endpoint.
If you work with JWT tokens only and expect that a matching JsonWebKey
will always be available (possibly after a key set refresh) then you should disable the token introspection:
quarkus.oidc.token.allow-jwt-introspection=false
quarkus.oidc.token.allow-opaque-token-introspection=false
However, there could be cases where JWT tokens must be verified via the introspection only. It can be forced by configuring an introspection endpoint address only, for example, in case of Keycloak you can do it like this:
quarkus.oidc.auth-server-url=http://localhost:8180/realms/quarkus
quarkus.oidc.discovery-enabled=false
# Token Introspection endpoint: http://localhost:8180/realms/quarkus/protocol/openid-connect/tokens/introspect
quarkus.oidc.introspection-path=/protocol/openid-connect/tokens/introspect
Note that io.quarkus.oidc.TokenIntrospection
(a simple javax.json.JsonObject
wrapper) object will be created and can be either injected or accessed as a SecurityIdentity introspection
attribute if either JWT or opaque token has been successfully introspected.
Token Introspection and UserInfo Cache
All opaque and sometimes JWT Bearer access tokens have to be remotely introspected. If UserInfo
is also required then the same access token will be used to do a remote call to OpenID Connect Provider again. So, if UserInfo
is required and the current access token is opaque then for every such token there will be 2 remote calls done - one to introspect it and one to get UserInfo with it, and if the token is JWT then usually only a single remote call will be needed - to get UserInfo with it.
The cost of making up to 2 remote calls per every incoming bearer or code flow access token can sometimes be problematic.
If it is the case in your production then it can be recommended that the token introspection and UserInfo
data are cached for a short period of time, for example, for 3 or 5 minutes.
quarkus-oidc
provides quarkus.oidc.TokenIntrospectionCache
and quarkus.oidc.UserInfoCache
interfaces which can be used to implement @ApplicationScoped
cache implementation which can be used to store and retrieve quarkus.oidc.TokenIntrospection
and/or quarkus.oidc.UserInfo
objects, for example:
@ApplicationScoped
@AlternativePriority(1)
public class CustomIntrospectionUserInfoCache implements TokenIntrospectionCache, UserInfoCache {
...
}
Each OIDC tenant can either permit or deny storing its quarkus.oidc.TokenIntrospection
and/or quarkus.oidc.UserInfo
data with boolean quarkus.oidc."tenant".allow-token-introspection-cache
and quarkus.oidc."tenant".allow-user-info-cache
properties.
Additionally, quarkus-oidc
provides a simple default memory based token cache which implements both quarkus.oidc.TokenIntrospectionCache
and quarkus.oidc.UserInfoCache
interfaces.
It can be activated and configured as follows:
# 'max-size' is 0 by default so the cache can be activated by setting 'max-size' to a positive value.
quarkus.oidc.token-cache.max-size=1000
# 'time-to-live' specifies how long a cache entry can be valid for and will be used by a clean up timer.
quarkus.oidc.token-cache.time-to-live=3M
# 'clean-up-timer-interval' is not set by default so the clean up timer can be activated by setting 'clean-up-timer-interval'.
quarkus.oidc.token-cache.clean-up-timer-interval=1M
The default cache uses a token as a key and each entry can have TokenIntrospection
and/or UserInfo
. It will only keep up to a max-size
number of entries. If the cache is full when a new entry is to be added then an attempt will be made to find a space for it by removing a single expired entry. Additionally, the clean up timer, if activated, will periodically check for the expired entries and remove them.
Please experiment with the default cache implementation or register a custom one.
JSON Web Token Claim Verification
Once the bearer JWT token’s signature has been verified and its expires at
(exp
) claim has been checked, the iss
(issuer
) claim value is verified next.
By default, the iss
claim value is compared to the issuer
property which may have been discovered in the well-known provider configuration.
But if quarkus.oidc.token.issuer
property is set then the iss
claim value is compared to it instead.
In some cases, this iss
claim verification may not work. For example, if the discovered issuer
property contains an internal HTTP/IP address while the token iss
claim value contains an external HTTP/IP address. Or when a discovered issuer
property contains the template tenant variable but the token iss
claim value has the complete tenant-specific issuer value.
In such cases you may want to consider skipping the issuer verification by setting quarkus.oidc.token.issuer=any
. Please note that it is not recommended and should be avoided unless no other options are available:
-
If you work with Keycloak and observe the issuer verification errors due to the different host addresses then configure Keycloak with a
KEYCLOAK_FRONTEND_URL
property to ensure the same host address is used. -
If the
iss
property is tenant specific in a multi-tenant deployment then you can use theSecurityIdentity
tenant-id
attribute to check the issuer is correct in the endpoint itself or the custom JAX-RS filter, for example:
import javax.inject.Inject;
import javax.ws.rs.container.ContainerRequestContext;
import javax.ws.rs.container.ContainerRequestFilter;
import javax.ws.rs.ext.Provider;
import org.eclipse.microprofile.jwt.JsonWebToken;
import io.quarkus.oidc.OidcConfigurationMetadata;
import io.quarkus.security.identity.SecurityIdentity;
@Provider
public class IssuerValidator implements ContainerRequestFilter {
@Inject
OidcConfigurationMetadata configMetadata;
@Inject JsonWebToken jwt;
@Inject SecurityIdentity identity;
public void filter(ContainerRequestContext requestContext) {
String issuer = configMetadata.getIssuer().replace("{tenant-id}", identity.getAttribute("tenant-id"));
if (!issuer.equals(jwt.getIssuer())) {
requestContext.abortWith(Response.status(401).build());
}
}
}
Note it is also recommended to use quarkus.oidc.token.audience
property to verify the token aud
(audience
) claim value.
Single Page Applications
Single Page Application (SPA) typically uses XMLHttpRequest
(XHR) and the Java Script utility code provided by the OpenID Connect provider to acquire a bearer token and use it
to access Quarkus service
applications.
For example, here is how you can use keycloak.js
to authenticate the users and refresh the expired tokens from the SPA:
<html>
<head>
<title>keycloak-spa</title>
<script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
<script src="http://localhost:8180/js/keycloak.js"></script>
<script>
var keycloak = new Keycloak();
keycloak.init({onLoad: 'login-required'}).success(function () {
console.log('User is now authenticated.');
}).error(function () {
window.location.reload();
});
function makeAjaxRequest() {
axios.get("/api/hello", {
headers: {
'Authorization': 'Bearer ' + keycloak.token
}
})
.then( function (response) {
console.log("Response: ", response.status);
}).catch(function (error) {
console.log('refreshing');
keycloak.updateToken(5).then(function () {
console.log('Token refreshed');
}).catch(function () {
console.log('Failed to refresh token');
window.location.reload();
});
});
}
</script>
</head>
<body>
<button onclick="makeAjaxRequest()">Request</button>
</body>
</html>
Cross Origin Resource Sharing
If you plan to consume your OpenID Connect service
application from a Single Page Application running on a different domain, you will need to configure CORS (Cross-Origin Resource Sharing). Please read the HTTP CORS documentation for more details.
Provider Endpoint configuration
OIDC service
application needs to know OpenID Connect provider’s token, JsonWebKey
(JWK) set and possibly UserInfo
and introspection endpoint addresses.
By default they are discovered by adding a /.well-known/openid-configuration
path to the configured quarkus.oidc.auth-server-url
.
Alternatively, if the discovery endpoint is not available or you would like to save on the discovery endpoint roundtrip, you can disable the discovery and configure them with relative path values, for example:
quarkus.oidc.auth-server-url=http://localhost:8180/realms/quarkus
quarkus.oidc.discovery-enabled=false
# Token endpoint: http://localhost:8180/realms/quarkus/protocol/openid-connect/token
quarkus.oidc.token-path=/protocol/openid-connect/token
# JWK set endpoint: http://localhost:8180/realms/quarkus/protocol/openid-connect/certs
quarkus.oidc.jwks-path=/protocol/openid-connect/certs
# UserInfo endpoint: http://localhost:8180/realms/quarkus/protocol/openid-connect/userinfo
quarkus.oidc.user-info-path=/protocol/openid-connect/userinfo
# Token Introspection endpoint: http://localhost:8180/realms/quarkus/protocol/openid-connect/tokens/introspect
quarkus.oidc.introspection-path=/protocol/openid-connect/tokens/introspect
Token Propagation
Please see Token Propagation section about the Bearer access token propagation to the downstream services.
Oidc Provider Client Authentication
quarkus.oidc.runtime.OidcProviderClient
is used when a remote request to an OpenID Connect Provider has to be done. If the bearer token has to be introspected then OidcProviderClient
has to authenticate to the OpenID Connect Provider. Please see OidcProviderClient Authentication for more information about all the supported authentication options.
Testing
Start by adding the following dependencies to your test project:
<dependency>
<groupId>io.rest-assured</groupId>
<artifactId>rest-assured</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>io.quarkus</groupId>
<artifactId>quarkus-junit5</artifactId>
<scope>test</scope>
</dependency>
testImplementation("io.rest-assured:rest-assured")
testImplementation("io.quarkus:quarkus-junit5")
Wiremock
Add the following dependencies to your test project:
<dependency>
<groupId>io.quarkus</groupId>
<artifactId>quarkus-test-oidc-server</artifactId>
<scope>test</scope>
</dependency>
testImplementation("io.quarkus:quarkus-test-oidc-server")
Prepare the REST test endpoint, set application.properties
, for example:
# keycloak.url is set by OidcWiremockTestResource
quarkus.oidc.auth-server-url=${keycloak.url}/realms/quarkus/
quarkus.oidc.client-id=quarkus-service-app
quarkus.oidc.application-type=service
and finally write the test code, for example:
import static org.hamcrest.Matchers.equalTo;
import java.util.Arrays;
import java.util.HashSet;
import org.hamcrest.Matchers;
import org.junit.jupiter.api.Test;
import io.quarkus.test.common.QuarkusTestResource;
import io.quarkus.test.junit.QuarkusTest;
import io.quarkus.test.oidc.server.OidcWiremockTestResource;
import io.restassured.RestAssured;
import io.smallrye.jwt.build.Jwt;
@QuarkusTest
@QuarkusTestResource(OidcWiremockTestResource.class)
public class BearerTokenAuthorizationTest {
@Test
public void testBearerToken() {
RestAssured.given().auth().oauth2(getAccessToken("alice", new HashSet<>(Arrays.asList("user"))))
.when().get("/api/users/preferredUserName")
.then()
.statusCode(200)
// the test endpoint returns the name extracted from the injected SecurityIdentity Principal
.body("userName", equalTo("alice"));
}
private String getAccessToken(String userName, Set<String> groups) {
return Jwt.preferredUserName(userName)
.groups(groups)
.issuer("https://server.example.com")
.audience("https://service.example.com")
.sign();
}
}
Note that the quarkus-test-oidc-server
extension includes a signing RSA private key file in a JSON Web Key
(JWK
) format and points to it with a smallrye.jwt.sign.key.location
configuration property. It allows to use a no argument sign()
operation to sign the token.
Testing your quarkus-oidc
service
application with OidcWiremockTestResource
provides the best coverage as even the communication channel is tested against the Wiremock HTTP stubs.
OidcWiremockTestResource
will be enhanced going forward to support more complex Bearer token test scenarios.
If there is an immediate need for a test to define Wiremock stubs not currently supported by OidcWiremockTestResource
one can do so via a WireMockServer
instance injected into the test class, for example:
package io.quarkus.it.keycloak;
import static com.github.tomakehurst.wiremock.client.WireMock.matching;
import static org.hamcrest.Matchers.equalTo;
import org.junit.jupiter.api.Test;
import com.github.tomakehurst.wiremock.WireMockServer;
import com.github.tomakehurst.wiremock.client.WireMock;
import io.quarkus.test.common.QuarkusTestResource;
import io.quarkus.test.junit.QuarkusTest;
import io.quarkus.test.oidc.server.OidcWireMock;
import io.quarkus.test.oidc.server.OidcWiremockTestResource;
import io.restassured.RestAssured;
@QuarkusTest
@QuarkusTestResource(OidcWiremockTestResource.class)
public class CustomOidcWireMockStubTest {
@OidcWireMock
WireMockServer wireMockServer;
@Test
public void testInvalidBearerToken() {
wireMockServer.stubFor(WireMock.post("/realms/quarkus/protocol/openid-connect/token/introspect")
.withRequestBody(matching(".*token=invalid_token.*"))
.willReturn(WireMock.aResponse().withStatus(400)));
RestAssured.given().auth().oauth2("invalid_token").when()
.get("/api/users/me/bearer")
.then()
.statusCode(401)
.header("WWW-Authenticate", equalTo("Bearer"));
}
}
Dev Services for Keycloak
Using Dev Services for Keycloak is recommended for the integration testing against Keycloak.
Dev Services for Keycloak
will launch and initialize a test container: it will create a quarkus
realm, a quarkus-app
client (secret
secret) and add alice
(admin
and user
roles) and bob
(user
role) users, where all of these properties can be customized.
First you need to add the following dependency:
<dependency>
<groupId>io.quarkus</groupId>
<artifactId>quarkus-test-keycloak-server</artifactId>
<scope>test</scope>
</dependency>
testImplementation("io.quarkus:quarkus-test-keycloak-server")
which provides a utility class io.quarkus.test.keycloak.client.KeycloakTestClient
you can use in tests for acquiring the access tokens.
Next prepare your application.properties
. You can start with a completely empty application.properties
as Dev Services for Keycloak
will register quarkus.oidc.auth-server-url
pointing to the running test container as well as quarkus.oidc.client-id=quarkus-app
and quarkus.oidc.credentials.secret=secret
.
But if you already have all the required quarkus-oidc
properties configured then you only need to associate quarkus.oidc.auth-server-url
with the prod
profile for `Dev Services for Keycloak`to start a container, for example:
%prod.quarkus.oidc.auth-server-url=http://localhost:8180/realms/quarkus
If a custom realm file has to be imported into Keycloak before running the tests then you can configure Dev Services for Keycloak
as follows:
%prod.quarkus.oidc.auth-server-url=http://localhost:8180/realms/quarkus
quarkus.keycloak.devservices.realm-path=quarkus-realm.json
Finally write your test which will be executed in JVM mode:
package org.acme.security.openid.connect;
import io.quarkus.test.junit.QuarkusTest;
import io.quarkus.test.keycloak.client.KeycloakTestClient;
import io.restassured.RestAssured;
import org.junit.jupiter.api.Test;
@QuarkusTest
public class BearerTokenAuthenticationTest {
KeycloakTestClient keycloakClient = new KeycloakTestClient();
@Test
public void testAdminAccess() {
RestAssured.given().auth().oauth2(getAccessToken("alice"))
.when().get("/api/admin")
.then()
.statusCode(200);
RestAssured.given().auth().oauth2(getAccessToken("bob"))
.when().get("/api/admin")
.then()
.statusCode(403);
}
protected String getAccessToken(String userName) {
return keycloakClient.getAccessToken(userName);
}
}
and in native mode:
package org.acme.security.openid.connect;
import io.quarkus.test.junit.QuarkusIntegrationTest;
@QuarkusIntegrationTest
public class NativeBearerTokenAuthenticationIT extends BearerTokenAuthenticationTest {
}
Please see Dev Services for Keycloak for more information about the way it is initialized and configured.
KeycloakTestResourceLifecycleManager
If you need to do some integration testing against Keycloak then you are encouraged to do it with Dev Services For Keycloak.
Use KeycloakTestResourceLifecycleManager
for your tests only if there is a good reason not to use Dev Services for Keycloak
.
Start with adding the following dependency:
<dependency>
<groupId>io.quarkus</groupId>
<artifactId>quarkus-test-keycloak-server</artifactId>
<scope>test</scope>
</dependency>
testImplementation("io.quarkus:quarkus-test-keycloak-server")
which provides io.quarkus.test.keycloak.server.KeycloakTestResourceLifecycleManager
- an implementation of io.quarkus.test.common.QuarkusTestResourceLifecycleManager
which starts a Keycloak container.
And configure the Maven Surefire plugin as follows:
<plugin>
<artifactId>maven-surefire-plugin</artifactId>
<configuration>
<systemPropertyVariables>
<!-- or, alternatively, configure 'keycloak.version' -->
<keycloak.docker.image>${keycloak.docker.image}</keycloak.docker.image>
<!--
Disable HTTPS if required:
<keycloak.use.https>false</keycloak.use.https>
-->
</systemPropertyVariables>
</configuration>
</plugin>
(and similarly maven.failsafe.plugin
when testing in native image).
Prepare the REST test endpoint, set application.properties
, for example:
# keycloak.url is set by KeycloakTestResourceLifecycleManager
quarkus.oidc.auth-server-url=${keycloak.url}/realms/quarkus/
quarkus.oidc.client-id=quarkus-service-app
quarkus.oidc.credentials=secret
quarkus.oidc.application-type=service
and finally write the test code, for example:
import static io.quarkus.test.keycloak.server.KeycloakTestResourceLifecycleManager.getAccessToken;
import static org.hamcrest.Matchers.equalTo;
import org.hamcrest.Matchers;
import org.junit.jupiter.api.Test;
import io.quarkus.test.common.QuarkusTestResource;
import io.quarkus.test.junit.QuarkusTest;
import io.quarkus.test.keycloak.server.KeycloakTestResourceLifecycleManager;
import io.restassured.RestAssured;
@QuarkusTest
@QuarkusTestResource(KeycloakTestResourceLifecycleManager.class)
public class BearerTokenAuthorizationTest {
@Test
public void testBearerToken() {
RestAssured.given().auth().oauth2(getAccessToken("alice"))))
.when().get("/api/users/preferredUserName")
.then()
.statusCode(200)
// the test endpoint returns the name extracted from the injected SecurityIdentity Principal
.body("userName", equalTo("alice"));
}
}
KeycloakTestResourceLifecycleManager
registers alice
and admin
users. The user alice
has the user
role only by default - it can be customized with a keycloak.token.user-roles
system property. The user admin
has the user
and admin
roles by default - it can be customized with a keycloak.token.admin-roles
system property.
By default, KeycloakTestResourceLifecycleManager
uses HTTPS to initialize a Keycloak instance which can be disabled with keycloak.use.https=false
.
Default realm name is quarkus
and client id - quarkus-service-app
- set keycloak.realm
and keycloak.service.client
system properties to customize the values if needed.
Local Public Key
You can also use a local inlined public key for testing your quarkus-oidc
service
applications:
quarkus.oidc.client-id=test
quarkus.oidc.public-key=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlivFI8qB4D0y2jy0CfEqFyy46R0o7S8TKpsx5xbHKoU1VWg6QkQm+ntyIv1p4kE1sPEQO73+HY8+Bzs75XwRTYL1BmR1w8J5hmjVWjc6R2BTBGAYRPFRhor3kpM6ni2SPmNNhurEAHw7TaqszP5eUF/F9+KEBWkwVta+PZ37bwqSE4sCb1soZFrVz/UT/LF4tYpuVYt3YbqToZ3pZOZ9AX2o1GCG3xwOjkc4x0W7ezbQZdC9iftPxVHR8irOijJRRjcPDtA6vPKpzLl6CyYnsIYPd99ltwxTHjr3npfv/3Lw50bAkbT4HeLFxTx4flEoZLKO/g0bAoV2uqBhkA9xnQIDAQAB
smallrye.jwt.sign.key.location=/privateKey.pem
copy privateKey.pem
from the integration-tests/oidc-tenancy
in the main
Quarkus repository and use a test code similar to the one in the Wiremock
section above to generate JWT tokens. You can use your own test keys if preferred.
This approach provides a more limited coverage compared to the Wiremock approach - for example, the remote communication code is not covered.
TestSecurity annotation
You can use @TestSecurity
and @OidcSecurity
annotations for testing the service
application endpoint code which depends on the injected JsonWebToken
as well as UserInfo
and OidcConfigurationMetadata
.
Add the following dependency:
<dependency>
<groupId>io.quarkus</groupId>
<artifactId>quarkus-test-security-oidc</artifactId>
<scope>test</scope>
</dependency>
testImplementation("io.quarkus:quarkus-test-security-oidc")
and write a test code like this one:
import static org.hamcrest.Matchers.is;
import org.junit.jupiter.api.Test;
import io.quarkus.test.common.http.TestHTTPEndpoint;
import io.quarkus.test.junit.QuarkusTest;
import io.quarkus.test.security.TestSecurity;
import io.quarkus.test.security.oidc.Claim;
import io.quarkus.test.security.oidc.ConfigMetadata;
import io.quarkus.test.security.oidc.OidcSecurity;
import io.quarkus.test.security.oidc.OidcConfigurationMetadata;
import io.quarkus.test.security.oidc.UserInfo;
import io.restassured.RestAssured;
@QuarkusTest
@TestHTTPEndpoint(ProtectedResource.class)
public class TestSecurityAuthTest {
@Test
@TestSecurity(user = "userOidc", roles = "viewer")
public void testOidc() {
RestAssured.when().get("test-security-oidc").then()
.body(is("userOidc:viewer"));
}
@Test
@TestSecurity(user = "userOidc", roles = "viewer")
@OidcSecurity(claims = {
@Claim(key = "email", value = "user@gmail.com")
}, userinfo = {
@UserInfo(key = "sub", value = "subject")
}, config = {
@ConfigMetadata(key = "issuer", value = "issuer")
})
public void testOidcWithClaimsUserInfoAndMetadata() {
RestAssured.when().get("test-security-oidc-claims-userinfo-metadata").then()
.body(is("userOidc:viewer:user@gmail.com:subject:issuer"));
}
}
where ProtectedResource
class may look like this:
import io.quarkus.oidc.OidcConfigurationMetadata;
import io.quarkus.oidc.UserInfo;
import org.eclipse.microprofile.jwt.JsonWebToken;
@Path("/service")
@Authenticated
public class ProtectedResource {
@Inject
JsonWebToken accessToken;
@Inject
UserInfo userInfo;
@Inject
OidcConfigurationMetadata configMetadata;
@GET
@Path("test-security-oidc")
public String testSecurityOidc() {
return accessToken.getName() + ":" + accessToken.getGroups().iterator().next();
}
@GET
@Path("test-security-oidc-claims-userinfo-metadata")
public String testSecurityOidcWithClaimsUserInfoMetadata() {
return accessToken.getName() + ":" + accessToken.getGroups().iterator().next()
+ ":" + accessToken.getClaim("email")
+ ":" + userInfo.getString("sub")
+ ":" + configMetadata.get("issuer");
}
}
Note that @TestSecurity
annotation must always be used and its user
property is returned as JsonWebToken.getName()
and roles
property - as JsonWebToken.getGroups()
.
@OidcSecurity
annotation is optional and can be used to set the additional token claims, as well as UserInfo
and OidcConfigurationMetadata
properties.
Additionally, if quarkus.oidc.token.issuer
property is configured then it will be used as an OidcConfigurationMetadata
issuer
property value.
If you work with the opaque tokens then you can test them as follows:
import static org.hamcrest.Matchers.is;
import org.junit.jupiter.api.Test;
import io.quarkus.test.common.http.TestHTTPEndpoint;
import io.quarkus.test.junit.QuarkusTest;
import io.quarkus.test.security.TestSecurity;
import io.quarkus.test.security.oidc.OidcSecurity;
import io.quarkus.test.security.oidc.TokenIntrospection;
import io.restassured.RestAssured;
@QuarkusTest
@TestHTTPEndpoint(ProtectedResource.class)
public class TestSecurityAuthTest {
@Test
@TestSecurity(user = "userOidc", roles = "viewer")
@OidcSecurity(introspectionRequired = true,
introspection = {
@TokenIntrospection(key = "email", value = "user@gmail.com")
}
)
public void testOidcWithClaimsUserInfoAndMetadata() {
RestAssured.when().get("test-security-oidc-claims-userinfo-metadata").then()
.body(is("userOidc:viewer:userOidc:viewer"));
}
}
where ProtectedResource
class may look like this:
import io.quarkus.oidc.TokenIntrospection;
import io.quarkus.security.identity.SecurityIdentity;
@Path("/service")
@Authenticated
public class ProtectedResource {
@Inject
SecurityIdentity securityIdentity;
@Inject
TokenIntrospection introspection;
@GET
@Path("test-security-oidc-opaque-token")
public String testSecurityOidcOpaqueToken() {
return securityIdentity.getPrincipal().getName() + ":" + securityIdentity.getRoles().iterator().next()
+ ":" + introspection.getString("username")
+ ":" + introspection.getString("scope")
+ ":" + introspection.getString("email");
}
}
Note that @TestSecurity
user
and roles
attributes are available as TokenIntrospection
username
and scope
properties and you can use io.quarkus.test.security.oidc.TokenIntrospection
to add the additional introspection response properties such as an email
, etc.
How to check the errors in the logs
Please enable io.quarkus.oidc.runtime.OidcProvider
TRACE
level logging to see more details about the token verification errors:
quarkus.log.category."io.quarkus.oidc.runtime.OidcProvider".level=TRACE
quarkus.log.category."io.quarkus.oidc.runtime.OidcProvider".min-level=TRACE
Please enable io.quarkus.oidc.runtime.OidcRecorder
TRACE
level logging to see more details about the OidcProvider client initialization errors:
quarkus.log.category."io.quarkus.oidc.runtime.OidcRecorder".level=TRACE
quarkus.log.category."io.quarkus.oidc.runtime.OidcRecorder".min-level=TRACE
External and Internal Access to OpenID Connect Provider
Note that the OpenID Connect Provider externally accessible token and other endpoints may have different HTTP(S) URLs compared to the URLs auto-discovered or configured relative to quarkus.oidc.auth-server-url
internal URL. For example, if your SPA acquires a token from an external token endpoint address and sends it to Quarkus as a Bearer token then an issuer verification failure may be reported by the endpoint.
In such cases, if you work with Keycloak then please start it with a KEYCLOAK_FRONTEND_URL
system property set to the externally accessible base URL.
If you work with other Openid Connect providers then please check your provider’s documentation.
How to use 'client-id' property
quarkus.oidc.client-id
property identifies an OpenID Connect Client which requested the current bearer token. It can be an SPA application running in a browser or a Quarkus web-app
confidential client application propagating the access token to the Quarkus service
application.
This property is required if the service
application is expected to introspect the tokens remotely - which is always the case for the opaque tokens.
This property is optional if the local Json Web Key token verification only is used.
Nonetheless, setting this property is encouraged even if the endpoint does not require an access to the remote introspection endpoint. The reasons behind it that client-id
, if set, can be used to verify the token audience and will also be included in the logs when the token verification fails for the better traceability of the tokens issued to specific clients to be analyzed over a longer period of time.
For example, if your OpenID Connect provider sets a token audience then the following configuration pattern is recommended:
# Set client-id
quarkus.oidc.client-id=quarkus-app
# Token audience claim must contain 'quarkus-app'
quarkus.oidc.token.audience=${quarkus.oidc.client-id}
If you set quarkus.oidc.client-id
but your endpoint does not require a remote access to one of OpenID Connect Provider endpoints (introspection, token acquisition, etc) then do not set a client secret with the quarkus.oidc.credentials
or similar properties as it will not be used.
Note Quarkus web-app
applications always require quarkus.oidc.client-id
property.