OIDC authentication for discovery endpoints

[01epa]

Description

I want to make oidc authentication in Quarkus service where auth service is Kubernetes.

So, i want to send a service account token to my quarkus service, validate it using public key (retrieved from OIDC endpoints), extract roles from token and perform authorization.

But when i tried to access well-know configuration endpoint I got 403 UnAuthorized. To access it I have to provide a service account token of my own service.

Kubernetes has a support of OIDC endpoints but they are closed with authentication

The recommended way to authenticate to the API server is with a service account credential.

Can you provide some way to set authorization header?

Probably it is better to add custom header interceptors to a client or some client customizer.

Here is a place where client created via new and later it is passed OidcCommonUtils.discoverMetadata() method

quarkus/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcRecorder.java

Line 474 in e5b9477

WebClient client = WebClient.create(new io.vertx.mutiny.core.Vertx(vertx), options);

Implementation ideas

No response

[quarkus-bot]

/cc @geoand (kubernetes), @iocanel (kubernetes), @pedroigor (oidc), @sberyozkin (oidc)

[sberyozkin]

@01epa This is now can be supported easily with the custom OidcRequestFilter, https://quarkus.io/guides/security-openid-connect-client-reference#oidc-client-filters, works for quarkus-oidc as well.

Specifically, this shows how to intercept discovery requests only:

https://github.com/quarkusio/quarkus/blob/main/integration-tests/oidc-wiremock/src/main/java/io/quarkus/it/keycloak/OidcDiscoveryRequestCustomizer.java

Can you try it and close the issue once you confirm it works ?

[sberyozkin]

@01epa 3.7.0.CR1 which will have this annotation feature is about to be released, but you can test even in 3.6.x, in 3.6.x one needs to check manually if the current request targets the discovery endpoint

[01epa]

I checked what you suggested. This is exactly what I wanted. Thanks. ALso i saw your MR with specifing endpoints to apply filter. Will wait next Qurkus release as well.

[sberyozkin]

@01epa FYI, 3.7.0.CR1 has just been released by @gsmet