AuthorizationController is not working after 2.2.0.Final #20144
Comments
|
@cemnura Hi Cem, do you still have a branch where you were looking at a similar issue ? Have a look please if yes |
|
@sberyozkin Hi Sergey, I still have the branch #16852. Let me update it to the latest Quarkus V2 and see what I can do for this. |
|
Hi @cemnura #16852 is addressing a different problem :-), I recall you started looking at the issue similar to what is described in this issue and then I asked you to look at #16852, since we now have |
|
I will have to search. But I can try to quickly create a reproducer. |
|
I created a reproducer(here) to see that the I tried with the Could the configuration property be incorrect? Added the following line to Also, adding the |
|
Testing with |
|
I messed around a little with It seems to be working just fine. I removed the oauth tokens from the test. Tests such as @Test
@TestSecurity(authorizationEnabled = false)
public void testAccessUserResource() {
RestAssured.given()
.when().get("/api/users/me")
.then()
.statusCode(200);
}Worked perfectly. However, I could get the following test to pass despite adding @Test
@Disabled // Not Working
@TestSecurity(authorizationEnabled = true, user = "alice", roles = {"user"})
public void testAccessAdminResource() {
RestAssured.given()
.when().get("/api/admin")
.then()
.statusCode(403);
}My intent was to test the endpoint with a user that does not have the admin role and get I also tried to remove Keycloak from booting up during the test by removing |
|
Hi @cemnura, @sberyozkin. Thanks for help with that issue. I have the following Quarkus authentication related content in config file: |
|
And what I discovered as well is that the problem occurs for Smallrye JWT RBAC, but not for OIDC. |
|
btw, you get this java.net.ConnectException in your reproducer most probably due to wrong quarkus.oidc.auth-server-url option in application.properties. If you set up your keycloak server according to README file, then the option should be: quarkus.oidc.auth-server-url=http://localhost:8180/auth/realms/quarkus |
|
Hello @andrewlunin, I created a reproducer here to have a look. I can disable and enable the Authorization with a custom @Alternative
@Priority(Interceptor.Priority.LIBRARY_BEFORE)
@ApplicationScoped
public class DisabledAuthController extends AuthorizationController {
@ConfigProperty(name = "disable.authorization", defaultValue = "false")
boolean disableAuthorization;
@Override
public boolean isAuthorizationEnabled() {
return !disableAuthorization;
}
}and by adjusting the configuration %dev.disable.authorization=true
Then I run
and curl works When I change the configuration back to
I can't curl to the endpoint Could you please check the difference between yours and the reproducer? Could there be a missing configuration? |
|
@sberyozkin I am trying out |
|
I will take a look @andrewlunin. Thanks for the reproducer seams interesting. |
|
I can see what you mean now. Yes, indeed I am getting 401 Authorization errors when using resteasy-reactive despite disabling. @sberyozkin any ideas were I can focus on? Checking @andrewlunin comment on possible commit being #19598. |
|
I traced the execution and found out that the 401 Unauthorized was occuring due to the EagerSecurityHandler throws This is neglecting the @sberyozkin could we inject the |
|
@cemnura Sorry, seeing it only now - I don't know why but I'm not always seeing the pings, strangely enough, I see it every time Thanks for spending your time on this issue, Can you please check if it works with @geoand - do you agree it would make sense for |
|
I'd be surprised if it's not fixed with 2.3.0.CR1. Can it be checked and also compared with the |
|
@andrewlunin Can you also please check |
|
@geoand I checked out Then the curl response is But when then we get the expected But when I change from Reproducer can be found here |
|
I quickly updated the quarkus version to
|
|
Thanks for the information. I'll take a look |
|
It seems that in order to solve this would would have to push the WDYT @stuartwdouglas ? |
Confirm - 2.3.0.CR1 is not working for me as well. |
|
@geoand is there anything I can look into? |
|
Not at the moment. I'll let you know :) |
Fixes quarkusio#20144 (cherry picked from commit 3e7bf2e)
Describe the bug
AuthorizationController is not working any more after 2.2.0.Final.
Expected behavior
Authorization is skipped.
Actual behavior
401Unauthorized returned if token not provided or invalid.
How to Reproduce?
No response
Output of
uname -aorverMicrosoft Windows [Version 10.0.18363.1734]
Output of
java -versionjava version "11.0.10" 2021-01-19 LTS
GraalVM version (if different from Java)
No response
Quarkus version or git rev
2.2.2.Final
Build tool (ie. output of
mvnw --versionorgradlew --version)Apache Maven 3.6.3
Additional information
This commit could probably cause the issue
The text was updated successfully, but these errors were encountered: