-
Notifications
You must be signed in to change notification settings - Fork 2.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
OIDC authentication for discovery endpoints #38246
Comments
/cc @geoand (kubernetes), @iocanel (kubernetes), @pedroigor (oidc), @sberyozkin (oidc) |
@01epa This is now can be supported easily with the custom Specifically, this shows how to intercept discovery requests only: Can you try it and close the issue once you confirm it works ? |
@01epa 3.7.0.CR1 which will have this annotation feature is about to be released, but you can test even in 3.6.x, in 3.6.x one needs to check manually if the current request targets the discovery endpoint |
I checked what you suggested. This is exactly what I wanted. Thanks. ALso i saw your MR with specifing endpoints to apply filter. Will wait next Qurkus release as well. |
Description
I want to make oidc authentication in Quarkus service where auth service is Kubernetes.
So, i want to send a service account token to my quarkus service, validate it using public key (retrieved from OIDC endpoints), extract roles from token and perform authorization.
But when i tried to access well-know configuration endpoint I got 403 UnAuthorized. To access it I have to provide a service account token of my own service.
Kubernetes has a support of OIDC endpoints but they are closed with authentication
Can you provide some way to set authorization header?
Probably it is better to add custom header interceptors to a client or some client customizer.
Here is a place where client created via
new
and later it is passedOidcCommonUtils.discoverMetadata()
methodquarkus/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcRecorder.java
Line 474 in e5b9477
Implementation ideas
No response
The text was updated successfully, but these errors were encountered: