Quarkus: Optional activation of Quarkus Security as JAX-RS filter

[sberyozkin]

Description
At the moment Quarkus Security is activated before a JAX-RS chain starts. The following issues are some of the issues that JAX-RS users may be seeing:

• They can't intercept Quarkus Security exceptions with ExceptionMapper
• Token auto-propagation which is free for MP RestClient is not possible

Implementation ideas
Activate Quarkus Security, when requested by the configuration property, as the very 1st prematch JAX-RS ContainerRequestFilter

CC @stuartwdouglas Hi Stuart not sure how feasible it is, and even if it is, if the complexity can be too high just to meet the above 2 cases, but lets talk a bit about it and see if it makes sense, thanks

[sberyozkin]

Hi Stuart @stuartwdouglas Can we discuss this option a bit more ? Without it we can't support the user provided custom JAX-RS exception mappers dealing with 401/403...Thanks

[stuartwdouglas]

Some of this already works, the rest can't really be done in a secure way.

Permission checks are done via CDI interceptors, so the failure is a normal exception that can be mapped as normal. If you want to map authentication failures as well as authorisation then you need to disable proactive auth, and then you can use an exception mapper for the resulting AuthenticationFailedException, as it will be generated from the interceptor rather than early in security handling.

What is the issue with token propagation?

[juandiii]

@stuartwdouglas Thanks for the tip! It's sound interesting about _proactive Authentication_!

[sberyozkin]

@stuartwdouglas This is cool, I'll give it a go and add a test a bit later on and also update the doc that the lazy authentication should be done for it to work...

[sberyozkin]

@stuartwdouglas

What is the issue with token propagation?

I'll need to check again, MP REST Client can auto-propagate the token, I thought, when I looked at it last time, it was not possible with the (proactive) approach, will check...

[stuartwdouglas]

The test for modifying the identity from a filter is here: https://github.com/quarkusio/quarkus/blob/70f8288021d7eea10f8e53d8cf22bef2cc924aef/extensions/resteasy/deployment/src/test/java/io/quarkus/resteasy/test/security/ReplaceIdentityLazyAuthRolesAllowedJaxRsTestCase.java#L17

[KaiHawai]

Hey Everybody, in the current quarkus (1.7.0) there is stil lthe behaviour that you get an 500 instead of an 403 when the JWT Token has expired. Will there be a Fix coming??