Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

4.x: Unified constants for configuring outbound id and secret. #7415

Merged
merged 2 commits into from Aug 23, 2023

Conversation

tomas-langer
Copy link
Member

Description

A single location to store constants that allow overriding of user id and secret (username and password for Basic authentication, user id for JWT).
This PR does not change Digest authentication at all, as we do not support outbound security with digest, and we do not plan to (it is an outdated insecure technology).

Related to #7207

Documentation

We had a few constants in the providers named EP_PROPERTY_OUTBOUND_USER and EP_PROPERTY_OUTBOUND_PASSWORD.
The new location is io.helidon.security.EndpointConfig.
New constants:

  • PROPERTY_OUTBOUND_ID - user name, client id to be used for the outbound call
  • PROPERTY_OUTBOUND_SECRET - password, client secret to be used for the outbound call

The set of providers supporting these constants is current unchanges (Basic authentication, JWT Authentication provider, and MP JWT Authentication provider).

To use, configure the client request similar to the following:

client.get()
  .uri(uri)
  .property(EndpointConfig.PROPERTY_OUTBOUND_ID, username)
  .property(EndpointConfig.PROPERTY_OUTBOUND_SECRET, password)
  .request();

And if the correct outbound provider is configured with web client security, the provided values will be used.
This also works when security is invoked manually through API (and other clients may support configuraiton of custom properites that are propagated to security).

@oracle-contributor-agreement oracle-contributor-agreement bot added the OCA Verified All contributors have signed the Oracle Contributor Agreement. label Aug 21, 2023
@tomas-langer tomas-langer self-assigned this Aug 21, 2023
@tomas-langer tomas-langer linked an issue Aug 21, 2023 that may be closed by this pull request
@tomas-langer tomas-langer merged commit 931139b into helidon-io:main Aug 23, 2023
12 checks passed
@tomas-langer tomas-langer deleted the 7207-outbound-id branch August 23, 2023 17:54
dalexandrov pushed a commit to dalexandrov/helidon that referenced this pull request Aug 26, 2023
…on-io#7415)

* Unified constants for configuring outbound id and secret.
* Renamed constants.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
OCA Verified All contributors have signed the Oracle Contributor Agreement.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4.x WebClient Security Digest Authentication
3 participants