OIDC Client: Is it possible?

[melloware]

@ricardozanini @hbelmiro apologize for opening this ticket but working with @mcruzdev i tried everything to figure this out and now i am starting to not think its possible.

1. I have a Quarkus REST server using OIDC authentication with KeyCloak. here is the server config.

quarkus.oidc.enabled=true
quarkus.oidc.client-id=my-client-id
quarkus.oidc.auth-server-url=http://localhost:8020/realms/myrealm

2. It generates this in the OpenAPI JSON:

    "securitySchemes" : {
      "SecurityScheme" : {
        "type" : "openIdConnect",
        "openIdConnectUrl" : "http://localhost:8020/realms/myrealm/.well-known/openid-configuration",
        "description" : "Authentication"
      }
    }

3. Now I want to use OpenAPIGenerator to generate my client code. I have read all the instructions: https://docs.quarkiverse.io/quarkus-openapi-generator/dev/client.html#_oauth2_authentication I have tried everything and no matter what it errors with cannot find package com..xxx.auth as its not generating the .auth filter.

Questions

Is OIDC supported?

If OIDC is not supported is the idea I need to turn off security quarkus.openapi-generator.codegen.enable-security-generation=false and create my OIDC client code and wire it into my generated code?

Feel free to close this ticket if its not valid but I think this will come up more and more as OIDC is popular.

[ricardozanini]

@melloware, this is supposed to work. If not, it might be a side effect of changes in the latest versions. Since we decided to go full Quarkus and generate Synthetic Beans instead of predefined template files for auth, we have been experiencing flaws.

I don't have the bandwidth to implement this fix in the short term. @gabriel-farache, could you mind taking a look too, since you're working on security-related features? It might impact your use cases.

[melloware]

I can provide a reproducer Quarkus server app if needed.

[gabriel-farache]

I can provide a reproducer Quarkus server app if needed.

@melloware yes, this can be useful, if you can do it, I'll gladly take it :)

[melloware]

@gabriel-farache here is a simple quarkus app using OIDC and it starts a KeyCoak DevService. In /src/main/openapi is there is generates the JSON and YML you can use to generate a client.

To run it just run mvn -Poidc. The KeyCloak users are alice/alice and bob/bob

quarkus-rest-oidc.zip

[indiealexh]

Came across this issue. I have a manual Rest Client in another application that uses the @RegisterProvider(OidcClientRequestReactiveFilter.class) annotation which works.

When using the OpenApi Client generator it does the same at @melloware. I will take a look into this and see if I can resolve it. If you don't hear from me in 2 days assume I failed.

---

Edit 1:

From what I can see, only type of "oauth2" is supported (included in the tests), I suspect openIdConnect is simply not implemented. I do not currently think I have the brain power to learn enough about extensions to implement this myself, but Im still investigating.

Edit 2:

So yeah, I confirmed its not seeing "openidConnect" option, so I guess it just needs built. I can try and have a stab at it, but I am not confident in my ability to do it correctly as I don't fully understand how extension code works other than at a high level.

---

Edit 3:

For anyone needing a workaround, you can use the oauth2 config

openapi.yml

// ...
  securitySchemes:
    Keycloak:
      type: openIdConnect
      description: Authentication
      openIdConnectUrl: https://localhost:8080/auth/realms/master/protocol/openid-connect/certs
    SecurityScheme:  
      type: oauth2
      flows:
        clientCredentials:
          authorizationUrl: https://example.com/oauth
          tokenUrl: https://example.com/oauth/token
          scopes: { }

application.yaml (.properties)

  quarkus:
    rest-client:
      openapi_yml:
        url: "https://openapi-api.example.com/"
    oidc-client:
      auth-server-url: "https://keycloak-oidc.example.com/realms/example"
      credentials:
        secret: "xxxxx"
      SecurityScheme:
        auth-server-url: "https://keycloak-oidc.example.com/realms/example"
        discovery-enabled: true
        client-id: "client-id"
        credentials:
          secret: "xxxx"

[melloware]

@indiealexh awesome! Good luck!

[ricardozanini]

@indiealexh should be fairly simple to add openidConnect to the list of implementations and leverage the OAuth2 feature.

[indiealexh]

Still working on verifying my "fix" for this, but after digging it looks like it MIGHT be as simple as:

[indiealexh]

Ok! After a lot of messy flailing around and clean up... Here it is! #1284