Initial token validation support for the issuer and audience claims #5944
Conversation
|
@pedroigor, @stuartwdouglas please note that setting an |
| * Configuration how to validate the token claims. | ||
| */ | ||
| @ConfigItem | ||
| Claims claims; |
There was a problem hiding this comment.
I'm not sure about quarkus.oidc.claims config property. It may clash with the claims request parameter as defined by https://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter.
Maybe, we could use quarkus.oidc.token.issuer|audience ?
There was a problem hiding this comment.
@pedroigor Good point, please believe me a token qualifier was something I thought for a sec or two about as well :-), because we may want to actually have an option to have both id token and access token validated separately, right now this validation will affect either the id token or access token depending on the application type. But in time we may qualify further and introduce an idtoken group if needed.
Recall though we already have an Authentication group which has scopes but will also host more properties related to the redirect, but in any case, it is good to avoid the confusion, so I'll rename shortly
Thanks
|
@gsmet Just downloaded the logs, KC tests are good, I can't even see what is failing :-) |
|
@stuartwdouglas @pedroigor please check it again |
| try { | ||
| OidcUtils.validateClaims(config.token, token.accessToken()); | ||
| } catch (OIDCException e) { | ||
| result.completeExceptionally(new AuthenticationFailedException()); |
There was a problem hiding this comment.
This should log at debug level or include the cause.
There was a problem hiding this comment.
@stuartwdouglas sure, I forgot to update it to include the cause
| Object claimValue = json.getValue(Claims.aud.name()); | ||
| List<String> audience = Collections.emptyList(); | ||
| if (claimValue instanceof JsonArray) { | ||
| audience = ((JsonArray) claimValue).stream().map(v -> v.toString()).collect(Collectors.toList()); |
There was a problem hiding this comment.
We don't allow lambda in runtime code, they use up a significant amount of additional memory.
4 participants
Fixes #5829