OIDC Token Validation Responses

[MatthewThomasTiani]

Hi,

I am writing an SSO application where I receive a bearer token generated in an external system, I perform validation, I then re-issue a token our services support, and then redirect the client to the relevant application.

In my application, I am using quarkus.oidc to validate a bearer token, and on a failure, the HTTP response provides very limited information to the client.

----------------------------RESPONSE---------------------------
STATUS: 401[Unauthorized]
HEADERS:
	www-authenticate:[Bearer]

I have developed a SecurityEvent observer to log the error in question, which is great for me when debugging and supporting customers, e.g.

Failure [tenant-key1]: Token age exceeds the configured token age property Additional details: [[24] Token age exceeds the configured token age property]: org.jose4j.jwt.consumer.InvalidJwtException: Token age exceeds the configured token age property Additional details: [[24] Token age exceeds the configured token age property]
	at io.quarkus.oidc.runtime.OidcProvider.verifyTokenAge(OidcProvider.java:328)
	at io.quarkus.oidc.runtime.OidcProvider.verifyJwtTokenInternal(OidcProvider.java:299)
...

However, it would be nice to add an error_description to the already existing HTTP response so the client can have some relevant information they can act on. I believe this is specified in RFC6750

Apologies if I have completely missed how to do this, but I have searched the documentation and the PRs/Discussion threads for the answer and have come up short.

Any help would be appreciated!

Thanks,
Matthew

[sberyozkin]

Hi, in dev mode more info should be returned.

In prod, Quarkus OIDC can't do it to avoid leaking details that may be used to narrow down the attack surface.

You can register a custom AuthenticationFailedException JAX-RS exception mapper to customize a response

[MatthewThomasTiani]

Hi @sberyozkin,

Thanks for the response. I assumed as much.

I think for our customers, it may be prudent to provide an exception mapper to provide more detail during the integration phase and ensure it's not present during production.

Thanks,
Matthew

[sberyozkin]

Thanks @MatthewThomasTiani, in devmode the extra details should be reported.
Perhaps you can make the exception mapper configurable, make it actionable if the integration profile is enabled