OIDC: New tenant specific service to map a TokenCredential to a SecurityIdentity

[knutwannheden]

Description

With #24051 an attempt was made to allow the OidcIdentityProvider to be used to parse an access token and map it to a SecurityIdentity. However, the OidcIdentityProvider implements multi-tenancy and to determine the applicable tenant it needs the Vert.x RoutingContext (cf. DefaultTenantConfigResolver#resolveContext()), which thus won't work when there is no request (e.g. when processing is triggered from the scheduler).

Thus, this issue requests a new injectable service which represents a tenant-specific configuration (request scoped), which would allow mapping a TokenCredential (or TokenAuthenticationRequest?) to a SecurityIdentity. A dedicated annotation would allow injecting the service for the default tenant configuration or a named tenant configuration (name as given in Quarkus configuration).

Implementation ideas

The PR #24051 provides a test case that may serve as an example and basis for a test for this feature.

[quarkus-bot]

/cc @pedroigor, @sberyozkin

[sberyozkin]

@michalvavrik Just FYI, please add to your queue if it can be of interest. I think this can indeed be a useful enhancement - it is about verifying the bearer access after the request has been completed, I've seen more than one query about it.

[michalvavrik]

I'm on it.