Using OpenID Connect (OIDC) to Protect Service Applications using Bearer Token Authorization

./attributes.adoc :toc:

This guide demonstrates how to use Quarkus OpenID Connect (OIDC) Extension to protect your JAX-RS applications using Bearer Token Authorization where Bearer Tokens are issued by OpenID Connect and OAuth 2.0 compliant Authorization Servers such as Keycloak.

Bearer Token Authorization is the process of authorizing HTTP requests based on the existence and validity of a Bearer Token which provides valuable information to determine the subject of the call as well as whether or not an HTTP resource can be accessed.

Please read the Using OpenID Connect to Protect Web Applications guide if you need to authenticate and authorize the users using OpenID Connect Authorization Code Flow.

If you use Keycloak and Bearer tokens then also see the Using Keycloak to Centralize Authorization guide.

Please read the Using OpenID Connect Multi-Tenancy guide how to support multiple tenants.

Quickstart

Prerequisites

includes/devtools/prerequisites.adoc * jq tool

Architecture

In this example, we build a very simple microservice which offers two endpoints:

/api/users/me
/api/admin

These endpoints are protected and can only be accessed if a client is sending a bearer token along with the request, which must be valid (e.g.: signature, expiration and audience) and trusted by the microservice.

The bearer token is issued by a Keycloak Server and represents the subject to which the token was issued for. For being an OAuth 2.0 Authorization Server, the token also references the client acting on behalf of the user.

The /api/users/me endpoint can be accessed by any user with a valid token. As a response, it returns a JSON document with details about the user where these details are obtained from the information carried on the token.

The /api/admin endpoint is protected with RBAC (Role-Based Access Control) where only users granted with the admin role can access. At this endpoint, we use the @RolesAllowed annotation to declaratively enforce the access constraint.

Solution

We recommend that you follow the instructions in the next sections and create the application step by step. However, you can go right to the completed example.

Clone the Git repository: git clone {quickstarts-clone-url}, or download an {quickstarts-archive-url}[archive].

The solution is located in the security-openid-connect-quickstart {quickstarts-tree-url}/security-openid-connect-quickstart[directory].

Creating the Maven Project

First, we need a new project. Create a new project with the following command:

includes/devtools/create-app.adoc

This command generates a Maven project, importing the keycloak extension which is an implementation of a Keycloak Adapter for Quarkus applications and provides all the necessary capabilities to integrate with a Keycloak Server and perform bearer token authorization.

If you already have your Quarkus project configured, you can add the oidc extension to your project by running the following command in your project base directory:

includes/devtools/extension-add.adoc

This will add the following to your build file:

pom.xml

<dependency>
    <groupId>io.quarkus</groupId>
    <artifactId>quarkus-oidc</artifactId>
</dependency>

build.gradle

implementation("io.quarkus:quarkus-oidc")

Writing the application

Let’s start by implementing the /api/users/me endpoint. As you can see from the source code below it is just a regular JAX-RS resource:

package org.acme.security.openid.connect;

import javax.annotation.security.RolesAllowed;
import javax.inject.Inject;
import javax.ws.rs.GET;
import javax.ws.rs.Path;

import org.jboss.resteasy.annotations.cache.NoCache;
import io.quarkus.security.identity.SecurityIdentity;

@Path("/api/users")
public class UsersResource {

    @Inject
    SecurityIdentity securityIdentity;

    @GET
    @Path("/me")
    @RolesAllowed("user")
    @NoCache
    public User me() {
        return new User(securityIdentity);
    }

    public static class User {

        private final String userName;

        User(SecurityIdentity securityIdentity) {
            this.userName = securityIdentity.getPrincipal().getName();
        }

        public String getUserName() {
            return userName;
        }
    }
}

The source code for the /api/admin endpoint is also very simple. The main difference here is that we are using a @RolesAllowed annotation to make sure that only users granted with the admin role can access the endpoint:

package org.acme.security.openid.connect;

import javax.annotation.security.RolesAllowed;
import javax.ws.rs.GET;
import javax.ws.rs.Path;
import javax.ws.rs.Produces;
import javax.ws.rs.core.MediaType;

@Path("/api/admin")
public class AdminResource {

    @GET
    @RolesAllowed("admin")
    @Produces(MediaType.TEXT_PLAIN)
    public String admin() {
        return "granted";
    }
}

Injection of the SecurityIdentity is supported in both @RequestScoped and @ApplicationScoped contexts.

Configuring the application

The OpenID Connect extension allows you to define the adapter configuration using the application.properties file which should be located at the src/main/resources directory.

{generated-dir}/config/quarkus-oidc.adoc

Example configuration:

%prod.quarkus.oidc.auth-server-url=http://localhost:8180/auth/realms/quarkus
quarkus.oidc.client-id=backend-service
quarkus.oidc.client-secret=secret

# Tell Dev Services for Keycloak to import the realm file
# This property is not effective when running the application in JVM or Native modes

quarkus.keycloak.devservices.realm-path=quarkus-realm.json

Note	Adding a `%prod.` profile prefix to `quarkus.oidc.auth-server-url` ensures that `Dev Services for Keycloak` will launch a container for you when the application is run in a dev mode. See Running the Application in Dev mode section below for more information.

Starting and Configuring the Keycloak Server

Note	Do not start the Keycloak server when you run the application in a dev mode - `Dev Services for Keycloak` will launch a container. See Running the Application in Dev mode section below for more information.

To start a Keycloak Server you can use Docker and just run the following command:

docker run --name keycloak -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=admin -p 8180:8080 quay.io/keycloak/keycloak:{keycloak.version} start-dev

where keycloak.version should be set to 17.0.0 or higher.

You should be able to access your Keycloak Server at localhost:8180.

Log in as the admin user to access the Keycloak Administration Console. Username should be admin and password admin.

Import the {quickstarts-tree-url}/security-openid-connect-quickstart/config/quarkus-realm.json[realm configuration file] to create a new realm. For more details, see the Keycloak documentation about how to create a new realm.

Note	If you want to use the Keycloak Admin Client to configure your server from your application you need to include the `quarkus-keycloak-admin-client` extension.

Running the Application in Dev mode

To run the application in a dev mode, use:

includes/devtools/dev.adoc

Dev Services for Keycloak will launch a Keycloak container and import a quarkus-realm.json.

Open a Dev UI available at /q/dev and click on a Provider: Keycloak link in an OpenID Connect Dev UI card.

You will be asked to login into a Single Page Application provided by OpenID Connect Dev UI:

Login as alice (password: alice) who has a user role
- accessing /api/admin will return 403
- accessing /api/users/me will return 200
Logout and login as admin (password: admin) who has both admin and user roles
- accessing /api/admin will return 200
- accessing /api/users/me will return 200

Running the Application in JVM mode

When you’re done playing with the dev mode" you can run it as a standard Java application.

First compile it:

includes/devtools/build.adoc

Then run it:

java -jar target/quarkus-app/quarkus-run.jar

Running the Application in Native Mode

This same demo can be compiled into native code: no modifications required.

This implies that you no longer need to install a JVM on your production environment, as the runtime technology is included in the produced binary, and optimized to run with minimal resource overhead.

Compilation will take a bit longer, so this step is disabled by default; let’s build again by enabling the native profile:

includes/devtools/build-native.adoc

After getting a cup of coffee, you’ll be able to run this binary directly:

./target/security-openid-connect-quickstart-runner

Testing the Application

See Running the Application in Dev mode section above about testing your application in a dev mode.

You can test the application launched in JVM or Native modes with curl.

The application is using bearer token authorization and the first thing to do is obtain an access token from the Keycloak Server in order to access the application resources:

export access_token=$(\
    curl --insecure -X POST https://localhost:8543/auth/realms/quarkus/protocol/openid-connect/token \
    --user backend-service:secret \
    -H 'content-type: application/x-www-form-urlencoded' \
    -d 'username=alice&password=alice&grant_type=password' | jq --raw-output '.access_token' \
 )

The example above obtains an access token for user alice.

Any user is allowed to access the http://localhost:8080/api/users/me endpoint which basically returns a JSON payload with details about the user.

curl -v -X GET \
  http://localhost:8080/api/users/me \
  -H "Authorization: Bearer "$access_token

The http://localhost:8080/api/admin endpoint can only be accessed by users with the admin role. If you try to access this endpoint with the previously issued access token, you should get a 403 response from the server.

curl -v -X GET \
   http://localhost:8080/api/admin \
   -H "Authorization: Bearer "$access_token

In order to access the admin endpoint you should obtain a token for the admin user:

export access_token=$(\
    curl --insecure -X POST https://localhost:8543/auth/realms/quarkus/protocol/openid-connect/token \
    --user backend-service:secret \
    -H 'content-type: application/x-www-form-urlencoded' \
    -d 'username=admin&password=admin&grant_type=password' | jq --raw-output '.access_token' \
 )

Please also see the Dev Services for Keycloak section below about writing the integration tests which depend on Dev Services for Keycloak.

Reference Guide

Accessing JWT claims

If you need to access JWT token claims then you can inject JsonWebToken:

package org.acme.security.openid.connect;

import org.eclipse.microprofile.jwt.JsonWebToken;
import javax.inject.Inject;
import javax.annotation.security.RolesAllowed;
import javax.ws.rs.GET;
import javax.ws.rs.Path;
import javax.ws.rs.Produces;
import javax.ws.rs.core.MediaType;

@Path("/api/admin")
public class AdminResource {

    @Inject
    JsonWebToken jwt;

    @GET
    @RolesAllowed("admin")
    @Produces(MediaType.TEXT_PLAIN)
    public String admin() {
        return "Access for subject " + jwt.getSubject() + " is granted";
    }
}

Injection of JsonWebToken is supported in @ApplicationScoped, @Singleton and @RequestScoped scopes however the use of @RequestScoped is required if the individual claims are injected as simple types, please see Support Injection Scopes for JsonWebToken and Claims for more details.

User Info

Set quarkus.oidc.authentication.user-info-required=true if a UserInfo JSON object from the OIDC userinfo endpoint has to be requested. A request will be sent to the OpenID Provider UserInfo endpoint and an io.quarkus.oidc.UserInfo (a simple javax.json.JsonObject wrapper) object will be created. io.quarkus.oidc.UserInfo can be either injected or accessed as a SecurityIdentity userinfo attribute.

Configuration Metadata

The current tenant’s discovered OpenID Connect Configuration Metadata is represented by io.quarkus.oidc.OidcConfigurationMetadata and can be either injected or accessed as a SecurityIdentity configuration-metadata attribute.

The default tenant’s OidcConfigurationMetadata is injected if the endpoint is public.

Token Claims And SecurityIdentity Roles

SecurityIdentity roles can be mapped from the verified JWT access tokens as follows:

If quarkus.oidc.roles.role-claim-path property is set and matching array or string claims are found then the roles are extracted from these claims. For example, customroles, customroles/array, scope, "http://namespace-qualified-custom-claim"/roles, "http://namespace-qualified-roles", etc.
If groups claim is available then its value is used
If realm_access/roles or resource_access/client_id/roles (where client_id is the value of the quarkus.oidc.client-id property) claim is available then its value is used. This check supports the tokens issued by Keycloak

If the token is opaque (binary) then a scope property from the remote token introspection response will be used.

If UserInfo is the source of the roles then set quarkus.oidc.authentication.user-info-required=true and quarkus.oidc.roles.source=userinfo, and if needed, quarkus.oidc.roles.role-claim-path.

Additionally a custom SecurityIdentityAugmentor can also be used to add the roles as documented here.

Token Verification And Introspection

If the token is a JWT token then, by default, it will be verified with a JsonWebKey (JWK) key from a local JsonWebKeySet retrieved from the OpenID Connect Provider’s JWK endpoint. The token’s key identifier kid header value will be used to find the matching JWK key. If no matching JWK is available locally then JsonWebKeySet will be refreshed by fetching the current key set from the JWK endpoint. The JsonWebKeySet refresh can be repeated again only after the quarkus.oidc.token.forced-jwk-refresh-interval (default is 10 minutes) expires. If no matching JWK is available after the refresh then the JWT token will be sent to the OpenID Connect Provider’s token introspection endpoint.

If the token is opaque (it can be a binary token or an encrypted JWT token) then it will always be sent to the OpenID Connect Provider’s token introspection endpoint.

If you work with JWT tokens only and expect that a matching JsonWebKey will always be available (possibly after a key set refresh) then you should disable the token introspection:

quarkus.oidc.token.allow-jwt-introspection=false
quarkus.oidc.token.allow-opaque-token-introspection=false

However, there could be cases where JWT tokens must be verified via the introspection only. It can be forced by configuring an introspection endpoint address only, for example, in case of Keycloak you can do it like this:

quarkus.oidc.auth-server-url=http://localhost:8180/auth/realms/quarkus
quarkus.oidc.discovery-enabled=false
# Token Introspection endpoint: http://localhost:8180/auth/realms/quarkus/protocol/openid-connect/tokens/introspect
quarkus.oidc.introspection-path=/protocol/openid-connect/tokens/introspect

Note that io.quarkus.oidc.TokenIntrospection (a simple javax.json.JsonObject wrapper) object will be created and can be either injected or accessed as a SecurityIdentity introspection attribute if either JWT or opaque token has been successfully introspected.

Token Introspection and UserInfo Cache

All opaque and sometimes JWT Bearer access tokens have to be remotely introspected. If UserInfo is also required then the same access token will be used to do a remote call to OpenID Connect Provider again. So, if UserInfo is required and the current access token is opaque then for every such token there will be 2 remote calls done - one to introspect it and one to get UserInfo with it, and if the token is JWT then usually only a single remote call will be needed - to get UserInfo with it.

The cost of making up to 2 remote calls per every incoming bearer or code flow access token can sometimes be problematic.

If it is the case in your production then it can be recommended that the token introspection and UserInfo data are cached for a short period of time, for example, for 3 or 5 minutes.

quarkus-oidc provides quarkus.oidc.TokenIntrospectionCache and quarkus.oidc.UserInfoCache interfaces which can be used to implement @ApplicationScoped cache implementation which can be used to store and retrieve quarkus.oidc.TokenIntrospection and/or quarkus.oidc.UserInfo objects, for example:

@ApplicationScoped
@AlternativePriority(1)
public class CustomIntrospectionUserInfoCache implements TokenIntrospectionCache, UserInfoCache {
...
}

Each OIDC tenant can either permit or deny storing its quarkus.oidc.TokenIntrospection and/or quarkus.oidc.UserInfo data with boolean quarkus.oidc."tenant".allow-token-introspection-cache and quarkus.oidc."tenant".allow-user-info-cache properties.

Additionally, quarkus-oidc provides a simple default memory based token cache which implements both quarkus.oidc.TokenIntrospectionCache and quarkus.oidc.UserInfoCache interfaces.

It can be activated and configured as follows:

# 'max-size' is 0 by default so the cache can be activated by setting 'max-size' to a positive value.
quarkus.oidc.token-cache.max-size=1000
# 'time-to-live' specifies how long a cache entry can be valid for and will be used by a clean up timer.
quarkus.oidc.token-cache.time-to-live=3M
# 'clean-up-timer-interval' is not set by default so the clean up timer can be activated by setting 'clean-up-timer-interval'.
quarkus.oidc.token-cache.clean-up-timer-interval=1M

The default cache uses a token as a key and each entry can have TokenIntrospection and/or UserInfo. It will only keep up to a max-size number of entries. If the cache is full when a new entry is to be added then an attempt will be made to find a space for it by removing a single expired entry. Additionally, the clean up timer, if activated, will periodically check for the expired entries and remove them.

Please experiment with the default cache implementation or register a custom one.

JSON Web Token Claim Verification

Once the bearer JWT token’s signature has been verified and its expires at (exp) claim has been checked, the iss (issuer) claim value is verified next.

By default, the iss claim value is compared to the issuer property which may have been discovered in the well-known provider configuration. But if quarkus.oidc.token.issuer property is set then the iss claim value is compared to it instead.

In some cases, this iss claim verification may not work. For example, if the discovered issuer property contains an internal HTTP/IP address while the token iss claim value contains an external HTTP/IP address. Or when a discovered issuer property contains the template tenant variable but the token iss claim value has the complete tenant-specific issuer value.

In such cases you may want to consider skipping the issuer verification by setting quarkus.oidc.token.issuer=any. Please note that it is not recommended and should be avoided unless no other options are available:

If you work with Keycloak and observe the issuer verification errors due to the different host addresses then configure Keycloak with a KEYCLOAK_FRONTEND_URL property to ensure the same host address is used.
If the iss property is tenant specific in a multi-tenant deployment then you can use the SecurityIdentity tenant-id attribute to check the issuer is correct in the endpoint itself or the custom JAX-RS filter, for example:

import javax.inject.Inject;
import javax.ws.rs.container.ContainerRequestContext;
import javax.ws.rs.container.ContainerRequestFilter;
import javax.ws.rs.ext.Provider;

import org.eclipse.microprofile.jwt.JsonWebToken;
import io.quarkus.oidc.OidcConfigurationMetadata;
import io.quarkus.security.identity.SecurityIdentity;

@Provider
public class IssuerValidator implements ContainerRequestFilter {
    @Inject
    OidcConfigurationMetadata configMetadata;

    @Inject JsonWebToken jwt;
    @Inject SecurityIdentity identity;

    public void filter(ContainerRequestContext requestContext) {
        String issuer = configMetadata.getIssuer().replace("{tenant-id}", identity.getAttribute("tenant-id"));
        if (!issuer.equals(jwt.getIssuer())) {
            requestContext.abortWith(Response.status(401).build());
        }
    }
}

Note it is also recommended to use quarkus.oidc.token.audience property to verify the token aud (audience) claim value.

Single Page Applications

Single Page Application (SPA) typically uses XMLHttpRequest(XHR) and the Java Script utility code provided by the OpenID Connect provider to acquire a bearer token and use it to access Quarkus service applications.

For example, here is how you can use keycloak.js to authenticate the users and refresh the expired tokens from the SPA:

<html>
<head>
    <title>keycloak-spa</title>
    <script src="https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js"></script>
    <script src="http://localhost:8180/auth/js/keycloak.js"></script>
    <script>
        var keycloak = new Keycloak();
        keycloak.init({onLoad: 'login-required'}).success(function () {
            console.log('User is now authenticated.');
        }).error(function () {
            window.location.reload();
        });
        function makeAjaxRequest() {
            axios.get("/api/hello", {
                headers: {
                    'Authorization': 'Bearer ' + keycloak.token
                }
            })
            .then( function (response) {
                console.log("Response: ", response.status);
            }).catch(function (error) {
                console.log('refreshing');
                keycloak.updateToken(5).then(function () {
                    console.log('Token refreshed');
                }).catch(function () {
                    console.log('Failed to refresh token');
                    window.location.reload();
                });
            });
    }
    </script>
</head>
<body>
    <button onclick="makeAjaxRequest()">Request</button>
</body>
</html>

Cross Origin Resource Sharing

If you plan to consume your OpenID Connect service application from a Single Page Application running on a different domain, you will need to configure CORS (Cross-Origin Resource Sharing). Please read the HTTP CORS documentation for more details.

Provider Endpoint configuration

OIDC service application needs to know OpenID Connect provider’s token, JsonWebKey (JWK) set and possibly UserInfo and introspection endpoint addresses.

By default they are discovered by adding a /.well-known/openid-configuration path to the configured quarkus.oidc.auth-server-url.

Alternatively, if the discovery endpoint is not available or you would like to save on the discovery endpoint roundtrip, you can disable the discovery and configure them with relative path values, for example:

quarkus.oidc.auth-server-url=http://localhost:8180/auth/realms/quarkus
quarkus.oidc.discovery-enabled=false
# Token endpoint: http://localhost:8180/auth/realms/quarkus/protocol/openid-connect/token
quarkus.oidc.token-path=/protocol/openid-connect/token
# JWK set endpoint: http://localhost:8180/auth/realms/quarkus/protocol/openid-connect/certs
quarkus.oidc.jwks-path=/protocol/openid-connect/certs
# UserInfo endpoint: http://localhost:8180/auth/realms/quarkus/protocol/openid-connect/userinfo
quarkus.oidc.user-info-path=/protocol/openid-connect/userinfo
# Token Introspection endpoint: http://localhost:8180/auth/realms/quarkus/protocol/openid-connect/tokens/introspect
quarkus.oidc.introspection-path=/protocol/openid-connect/tokens/introspect

Token Propagation

Please see Token Propagation section about the Bearer access token propagation to the downstream services.

Oidc Provider Client Authentication

quarkus.oidc.runtime.OidcProviderClient is used when a remote request to an OpenID Connect Provider has to be done. If the bearer token has to be introspected then OidcProviderClient has to authenticate to the OpenID Connect Provider. Please see OidcProviderClient Authentication for more information about all the supported authentication options.

Testing

Start by adding the following dependencies to your test project:

pom.xml

<dependency>
    <groupId>io.rest-assured</groupId>
    <artifactId>rest-assured</artifactId>
    <scope>test</scope>
</dependency>
<dependency>
    <groupId>io.quarkus</groupId>
    <artifactId>quarkus-junit5</artifactId>
    <scope>test</scope>
</dependency>

build.gradle

testImplementation("io.rest-assured:rest-assured")
testImplementation("io.quarkus:quarkus-junit5")

Wiremock

Add the following dependencies to your test project:

pom.xml

<dependency>
    <groupId>io.quarkus</groupId>
    <artifactId>quarkus-test-oidc-server</artifactId>
    <scope>test</scope>
</dependency>

build.gradle

testImplementation("io.quarkus:quarkus-test-oidc-server")

Prepare the REST test endpoint, set application.properties, for example:

# keycloak.url is set by OidcWiremockTestResource
quarkus.oidc.auth-server-url=${keycloak.url}/realms/quarkus/
quarkus.oidc.client-id=quarkus-service-app
quarkus.oidc.application-type=service

and finally write the test code, for example:

import static org.hamcrest.Matchers.equalTo;

import java.util.Arrays;
import java.util.HashSet;

import org.hamcrest.Matchers;
import org.junit.jupiter.api.Test;

import io.quarkus.test.common.QuarkusTestResource;
import io.quarkus.test.junit.QuarkusTest;
import io.quarkus.test.oidc.server.OidcWiremockTestResource;
import io.restassured.RestAssured;
import io.smallrye.jwt.build.Jwt;

@QuarkusTest
@QuarkusTestResource(OidcWiremockTestResource.class)
public class BearerTokenAuthorizationTest {

    @Test
    public void testBearerToken() {
        RestAssured.given().auth().oauth2(getAccessToken("alice", new HashSet<>(Arrays.asList("user"))))
            .when().get("/api/users/preferredUserName")
            .then()
            .statusCode(200)
            // the test endpoint returns the name extracted from the injected SecurityIdentity Principal
            .body("userName", equalTo("alice"));
    }

    private String getAccessToken(String userName, Set<String> groups) {
        return Jwt.preferredUserName(userName)
                .groups(groups)
                .issuer("https://server.example.com")
                .audience("https://service.example.com")
                .sign();
    }
}

Note that the quarkus-test-oidc-server extension includes a signing RSA private key file in a JSON Web Key (JWK) format and points to it with a smallrye.jwt.sign.key.location configuration property. It allows to use a no argument sign() operation to sign the token.

Testing your quarkus-oidc service application with OidcWiremockTestResource provides the best coverage as even the communication channel is tested against the Wiremock HTTP stubs. OidcWiremockTestResource will be enhanced going forward to support more complex Bearer token test scenarios.

If there is an immediate need for a test to define Wiremock stubs not currently supported by OidcWiremockTestResource one can do so via a WireMockServer instance injected into the test class, for example:

package io.quarkus.it.keycloak;

import static com.github.tomakehurst.wiremock.client.WireMock.matching;
import static org.hamcrest.Matchers.equalTo;

import org.junit.jupiter.api.Test;

import com.github.tomakehurst.wiremock.WireMockServer;
import com.github.tomakehurst.wiremock.client.WireMock;

import io.quarkus.test.common.QuarkusTestResource;
import io.quarkus.test.junit.QuarkusTest;
import io.quarkus.test.oidc.server.OidcWireMock;
import io.quarkus.test.oidc.server.OidcWiremockTestResource;
import io.restassured.RestAssured;

@QuarkusTest
@QuarkusTestResource(OidcWiremockTestResource.class)
public class CustomOidcWireMockStubTest {

    @OidcWireMock
    WireMockServer wireMockServer;

    @Test
    public void testInvalidBearerToken() {
        wireMockServer.stubFor(WireMock.post("/auth/realms/quarkus/protocol/openid-connect/token/introspect")
                .withRequestBody(matching(".*token=invalid_token.*"))
                .willReturn(WireMock.aResponse().withStatus(400)));

        RestAssured.given().auth().oauth2("invalid_token").when()
                .get("/api/users/me/bearer")
                .then()
                .statusCode(401)
                .header("WWW-Authenticate", equalTo("Bearer"));
    }
}

Dev Services for Keycloak

Using Dev Services for Keycloak is recommended for the integration testing against Keycloak. Dev Services for Keycloak will launch and initialize a test container: it will create a quarkus realm, a quarkus-app client (secret secret) and add alice (admin and user roles) and bob (user role) users, where all of these properties can be customized.

First you need to add the following dependency:

pom.xml

<dependency>
    <groupId>io.quarkus</groupId>
    <artifactId>quarkus-test-keycloak-server</artifactId>
    <scope>test</scope>
</dependency>

build.gradle

testImplementation("io.quarkus:quarkus-test-keycloak-server")

which provides a utility class io.quarkus.test.keycloak.client.KeycloakTestClient you can use in tests for acquiring the access tokens.

Next prepare your application.properties. You can start with a completely empty application.properties as Dev Services for Keycloak will register quarkus.oidc.auth-server-url pointing to the running test container as well as quarkus.oidc.client-id=quarkus-app and quarkus.oidc.credentials.secret=secret.

But if you already have all the required quarkus-oidc properties configured then you only need to associate quarkus.oidc.auth-server-url with the prod profile for `Dev Services for Keycloak`to start a container, for example:

%prod.quarkus.oidc.auth-server-url=http://localhost:8180/auth/realms/quarkus

If a custom realm file has to be imported into Keycloak before running the tests then you can configure Dev Services for Keycloak as follows:

%prod.quarkus.oidc.auth-server-url=http://localhost:8180/auth/realms/quarkus
quarkus.keycloak.devservices.realm-path=quarkus-realm.json

Finally write your test which will be executed in JVM mode:

package org.acme.security.openid.connect;

import io.quarkus.test.junit.QuarkusTest;
import io.quarkus.test.keycloak.client.KeycloakTestClient;
import io.restassured.RestAssured;
import org.junit.jupiter.api.Test;

@QuarkusTest
public class BearerTokenAuthenticationTest {

    KeycloakTestClient keycloakClient = new KeycloakTestClient();

    @Test
    public void testAdminAccess() {
        RestAssured.given().auth().oauth2(getAccessToken("alice"))
                .when().get("/api/admin")
                .then()
                .statusCode(200);
        RestAssured.given().auth().oauth2(getAccessToken("bob"))
                .when().get("/api/admin")
                .then()
                .statusCode(403);
    }

    protected String getAccessToken(String userName) {
        return keycloakClient.getAccessToken(userName);
    }
}

and in native mode:

package org.acme.security.openid.connect;

import io.quarkus.test.junit.QuarkusIntegrationTest;

@QuarkusIntegrationTest
public class NativeBearerTokenAuthenticationIT extends BearerTokenAuthenticationTest {
}

Please see Dev Services for Keycloak for more information about the way it is initialized and configured.

KeycloakTestResourceLifecycleManager

If you need to do some integration testing against Keycloak then you are encouraged to do it with Dev Services For Keycloak. Use KeycloakTestResourceLifecycleManager for your tests only if there is a good reason not to use Dev Services for Keycloak.

Start with adding the following dependency:

pom.xml

<dependency>
    <groupId>io.quarkus</groupId>
    <artifactId>quarkus-test-keycloak-server</artifactId>
    <scope>test</scope>
</dependency>

build.gradle

testImplementation("io.quarkus:quarkus-test-keycloak-server")

which provides io.quarkus.test.keycloak.server.KeycloakTestResourceLifecycleManager - an implementation of io.quarkus.test.common.QuarkusTestResourceLifecycleManager which starts a Keycloak container.

And configure the Maven Surefire plugin as follows:

<plugin>
    <artifactId>maven-surefire-plugin</artifactId>
    <configuration>
        <systemPropertyVariables>
            <!-- or, alternatively, configure 'keycloak.version' -->
            <keycloak.docker.image>${keycloak.docker.image}</keycloak.docker.image>
            <!--
              Disable HTTPS if required:
              <keycloak.use.https>false</keycloak.use.https>
            -->
        </systemPropertyVariables>
    </configuration>
</plugin>

(and similarly maven.failsafe.plugin when testing in native image).

Prepare the REST test endpoint, set application.properties, for example:

# keycloak.url is set by KeycloakTestResourceLifecycleManager
quarkus.oidc.auth-server-url=${keycloak.url}/realms/quarkus/
quarkus.oidc.client-id=quarkus-service-app
quarkus.oidc.credentials=secret
quarkus.oidc.application-type=service

and finally write the test code, for example:

import static io.quarkus.test.keycloak.server.KeycloakTestResourceLifecycleManager.getAccessToken;
import static org.hamcrest.Matchers.equalTo;

import org.hamcrest.Matchers;
import org.junit.jupiter.api.Test;

import io.quarkus.test.common.QuarkusTestResource;
import io.quarkus.test.junit.QuarkusTest;
import io.quarkus.test.keycloak.server.KeycloakTestResourceLifecycleManager;
import io.restassured.RestAssured;

@QuarkusTest
@QuarkusTestResource(KeycloakTestResourceLifecycleManager.class)
public class BearerTokenAuthorizationTest {

    @Test
    public void testBearerToken() {
        RestAssured.given().auth().oauth2(getAccessToken("alice"))))
            .when().get("/api/users/preferredUserName")
            .then()
            .statusCode(200)
            // the test endpoint returns the name extracted from the injected SecurityIdentity Principal
            .body("userName", equalTo("alice"));
    }

}

KeycloakTestResourceLifecycleManager registers alice and admin users. The user alice has the user role only by default - it can be customized with a keycloak.token.user-roles system property. The user admin has the user and admin roles by default - it can be customized with a keycloak.token.admin-roles system property.

By default, KeycloakTestResourceLifecycleManager uses HTTPS to initialize a Keycloak instance which can be disabled with keycloak.use.https=false. Default realm name is quarkus and client id - quarkus-service-app - set keycloak.realm and keycloak.service.client system properties to customize the values if needed.

Local Public Key

You can also use a local inlined public key for testing your quarkus-oidc service applications:

quarkus.oidc.client-id=test
quarkus.oidc.public-key=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlivFI8qB4D0y2jy0CfEqFyy46R0o7S8TKpsx5xbHKoU1VWg6QkQm+ntyIv1p4kE1sPEQO73+HY8+Bzs75XwRTYL1BmR1w8J5hmjVWjc6R2BTBGAYRPFRhor3kpM6ni2SPmNNhurEAHw7TaqszP5eUF/F9+KEBWkwVta+PZ37bwqSE4sCb1soZFrVz/UT/LF4tYpuVYt3YbqToZ3pZOZ9AX2o1GCG3xwOjkc4x0W7ezbQZdC9iftPxVHR8irOijJRRjcPDtA6vPKpzLl6CyYnsIYPd99ltwxTHjr3npfv/3Lw50bAkbT4HeLFxTx4flEoZLKO/g0bAoV2uqBhkA9xnQIDAQAB

smallrye.jwt.sign.key.location=/privateKey.pem

copy privateKey.pem from the integration-tests/oidc-tenancy in the main Quarkus repository and use a test code similar to the one in the Wiremock section above to generate JWT tokens. You can use your own test keys if preferred.

This approach provides a more limited coverage compared to the Wiremock approach - for example, the remote communication code is not covered.

TestSecurity annotation

You can use @TestSecurity and @OidcSecurity annotations for testing the service application endpoint code which depends on the injected JsonWebToken as well as UserInfo and OidcConfigurationMetadata.

Add the following dependency:

pom.xml

<dependency>
    <groupId>io.quarkus</groupId>
    <artifactId>quarkus-test-security-oidc</artifactId>
    <scope>test</scope>
</dependency>

build.gradle

testImplementation("io.quarkus:quarkus-test-security-oidc")

and write a test code like this one:

import static org.hamcrest.Matchers.is;
import org.junit.jupiter.api.Test;
import io.quarkus.test.common.http.TestHTTPEndpoint;
import io.quarkus.test.junit.QuarkusTest;
import io.quarkus.test.security.TestSecurity;
import io.quarkus.test.security.oidc.Claim;
import io.quarkus.test.security.oidc.ConfigMetadata;
import io.quarkus.test.security.oidc.OidcSecurity;
import io.quarkus.test.security.oidc.OidcConfigurationMetadata;
import io.quarkus.test.security.oidc.UserInfo;
import io.restassured.RestAssured;

@QuarkusTest
@TestHTTPEndpoint(ProtectedResource.class)
public class TestSecurityAuthTest {

    @Test
    @TestSecurity(user = "userOidc", roles = "viewer")
    public void testOidc() {
        RestAssured.when().get("test-security-oidc").then()
                .body(is("userOidc:viewer"));
    }

    @Test
    @TestSecurity(user = "userOidc", roles = "viewer")
    @OidcSecurity(claims = {
            @Claim(key = "email", value = "user@gmail.com")
    }, userinfo = {
            @UserInfo(key = "sub", value = "subject")
    }, config = {
            @ConfigMetadata(key = "issuer", value = "issuer")
    })
    public void testOidcWithClaimsUserInfoAndMetadata() {
        RestAssured.when().get("test-security-oidc-claims-userinfo-metadata").then()
                .body(is("userOidc:viewer:user@gmail.com:subject:issuer"));
    }

}

where ProtectedResource class may look like this:

import io.quarkus.oidc.OidcConfigurationMetadata;
import io.quarkus.oidc.UserInfo;
import org.eclipse.microprofile.jwt.JsonWebToken;

@Path("/service")
@Authenticated
public class ProtectedResource {

    @Inject
    JsonWebToken accessToken;
    @Inject
    UserInfo userInfo;
    @Inject
    OidcConfigurationMetadata configMetadata;

    @GET
    @Path("test-security-oidc")
    public String testSecurityOidc() {
        return accessToken.getName() + ":" + accessToken.getGroups().iterator().next();
    }

    @GET
    @Path("test-security-oidc-claims-userinfo-metadata")
    public String testSecurityOidcWithClaimsUserInfoMetadata() {
        return accessToken.getName() + ":" + accessToken.getGroups().iterator().next()
                + ":" + accessToken.getClaim("email")
                + ":" + userInfo.getString("sub")
                + ":" + configMetadata.get("issuer");
    }
}

Note that @TestSecurity annotation must always be used and its user property is returned as JsonWebToken.getName() and roles property - as JsonWebToken.getGroups(). @OidcSecurity annotation is optional and can be used to set the additional token claims, as well as UserInfo and OidcConfigurationMetadata properties. Additionally, if quarkus.oidc.token.issuer property is configured then it will be used as an OidcConfigurationMetadata issuer property value.

If you work with the opaque tokens then you can test them as follows:

import static org.hamcrest.Matchers.is;
import org.junit.jupiter.api.Test;
import io.quarkus.test.common.http.TestHTTPEndpoint;
import io.quarkus.test.junit.QuarkusTest;
import io.quarkus.test.security.TestSecurity;
import io.quarkus.test.security.oidc.OidcSecurity;
import io.quarkus.test.security.oidc.TokenIntrospection;
import io.restassured.RestAssured;

@QuarkusTest
@TestHTTPEndpoint(ProtectedResource.class)
public class TestSecurityAuthTest {

    @Test
    @TestSecurity(user = "userOidc", roles = "viewer")
    @OidcSecurity(introspectionRequired = true,
        introspection = {
            @TokenIntrospection(key = "email", value = "user@gmail.com")
        }
    )
    public void testOidcWithClaimsUserInfoAndMetadata() {
        RestAssured.when().get("test-security-oidc-claims-userinfo-metadata").then()
                .body(is("userOidc:viewer:userOidc:viewer"));
    }

}

where ProtectedResource class may look like this:

import io.quarkus.oidc.TokenIntrospection;
import io.quarkus.security.identity.SecurityIdentity;

@Path("/service")
@Authenticated
public class ProtectedResource {

    @Inject
    SecurityIdentity securityIdentity;
    @Inject
    TokenIntrospection introspection;

    @GET
    @Path("test-security-oidc-opaque-token")
    public String testSecurityOidcOpaqueToken() {
        return securityIdentity.getPrincipal().getName() + ":" + securityIdentity.getRoles().iterator().next()
            + ":" + introspection.getString("username")
            + ":" + introspection.getString("scope")
            + ":" + introspection.getString("email");
    }
}

Note that @TestSecurity user and roles attributes are available as TokenIntrospection username and scope properties and you can use io.quarkus.test.security.oidc.TokenIntrospection to add the additional introspection response properties such as an email, etc.

How to check the errors in the logs

Please enable io.quarkus.oidc.runtime.OidcProvider TRACE level logging to see more details about the token verification errors:

quarkus.log.category."io.quarkus.oidc.runtime.OidcProvider".level=TRACE
quarkus.log.category."io.quarkus.oidc.runtime.OidcProvider".min-level=TRACE

Please enable io.quarkus.oidc.runtime.OidcRecorder TRACE level logging to see more details about the OidcProvider client initialization errors:

quarkus.log.category."io.quarkus.oidc.runtime.OidcRecorder".level=TRACE
quarkus.log.category."io.quarkus.oidc.runtime.OidcRecorder".min-level=TRACE

External and Internal Access to OpenID Connect Provider

Note that the OpenID Connect Provider externally accessible token and other endpoints may have different HTTP(S) URLs compared to the URLs auto-discovered or configured relative to quarkus.oidc.auth-server-url internal URL. For example, if your SPA acquires a token from an external token endpoint address and sends it to Quarkus as a Bearer token then an issuer verification failure may be reported by the endpoint.

In such cases, if you work with Keycloak then please start it with a KEYCLOAK_FRONTEND_URL system property set to the externally accessible base URL. If you work with other Openid Connect providers then please check your provider’s documentation.

How to use 'client-id' property

quarkus.oidc.client-id property identifies an OpenID Connect Client which requested the current bearer token. It can be an SPA application running in a browser or a Quarkus web-app confidential client application propagating the access token to the Quarkus service application.

This property is required if the service application is expected to introspect the tokens remotely - which is always the case for the opaque tokens. This property is optional if the local Json Web Key token verification only is used.

Nonetheless, setting this property is encouraged even if the endpoint does not require an access to the remote introspection endpoint. The reasons behind it that client-id, if set, can be used to verify the token audience and will also be included in the logs when the token verification fails for the better traceability of the tokens issued to specific clients to be analyzed over a longer period of time.

For example, if your OpenID Connect provider sets a token audience then the following configuration pattern is recommended:

# Set client-id
quarkus.oidc.client-id=quarkus-app
# Token audience claim must contain 'quarkus-app'
quarkus.oidc.token.audience=${quarkus.oidc.client-id}

If you set quarkus.oidc.client-id but your endpoint does not require a remote access to one of OpenID Connect Provider endpoints (introspection, token acquisition, etc) then do not set a client secret with the quarkus.oidc.credentials or similar properties as it will not be used.

Note Quarkus web-app applications always require quarkus.oidc.client-id property.

References

Keycloak Documentation
OpenID Connect
JSON Web Token
Quarkus - Using OpenID Connect and OAuth2 Client and Filters to manage access tokens
Dev Services for Keycloak
Sign and encrypt JWT tokens with SmallRye JWT Build
Summary of Quarkus OIDC, JWT and OAuth2 features
Quarkus Security

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

security-openid-connect.adoc

security-openid-connect.adoc

Using OpenID Connect (OIDC) to Protect Service Applications using Bearer Token Authorization

Quickstart

Prerequisites

Architecture

Solution

Creating the Maven Project

Writing the application

Configuring the application

Starting and Configuring the Keycloak Server

Running the Application in Dev mode

Running the Application in JVM mode

Running the Application in Native Mode

Testing the Application

Reference Guide

Accessing JWT claims

User Info

Configuration Metadata

Token Claims And SecurityIdentity Roles

Token Verification And Introspection

Token Introspection and UserInfo Cache

JSON Web Token Claim Verification

Single Page Applications

Provider Endpoint configuration

Token Propagation

Oidc Provider Client Authentication

Testing

Wiremock

Dev Services for Keycloak

KeycloakTestResourceLifecycleManager

Local Public Key

TestSecurity annotation

How to check the errors in the logs

External and Internal Access to OpenID Connect Provider

How to use 'client-id' property

References

Files

security-openid-connect.adoc

Latest commit

History

security-openid-connect.adoc

File metadata and controls

Using OpenID Connect (OIDC) to Protect Service Applications using Bearer Token Authorization

Quickstart

Prerequisites

Architecture

Solution

Creating the Maven Project

Writing the application

Configuring the application

Starting and Configuring the Keycloak Server

Running the Application in Dev mode

Running the Application in JVM mode

Running the Application in Native Mode

Testing the Application

Reference Guide

Accessing JWT claims

User Info

Configuration Metadata

Token Claims And SecurityIdentity Roles

Token Verification And Introspection

Token Introspection and UserInfo Cache

JSON Web Token Claim Verification

Single Page Applications

Cross Origin Resource Sharing

Provider Endpoint configuration

Token Propagation

Oidc Provider Client Authentication

Testing

Wiremock

Dev Services for Keycloak

KeycloakTestResourceLifecycleManager

Local Public Key

TestSecurity annotation

How to check the errors in the logs

External and Internal Access to OpenID Connect Provider

How to use 'client-id' property

References