quarkus api secured with Azure AD

[dkoci]

Hi folks.
Does anyone have some experience with quarkus api which use azure ad for authentication?
I have backend (quarkus api) and frontend (angular) which calls quarkus api. I have found some springboot examples, but it is not working with quarkus-oidc extension. I have googled alot, but more or less there are only quarkus/keycloak exaples.

Thank you

[sberyozkin]

Hi, I believe we've had many users confirming it works with Azure AD. There is no much difference between using Keycloak and Azure with quarkus-oidc. I'm assuming it is your frontend application which is actually authenticating the users, in which case all you need is to include the access token returned from Azure to invoke on Quarkus, use Authorization: Bearer <token> - I think just adding quarkus.oidc.auth-server-url=azure-address should be enough in this case, where azure-address identifies the Azure endpoint from where the verification keys and other OIDC info can be fetched from.

[dkoci]

Thank you for your answer. The problem was in server url. I had quarkus.oidc.auth-server-url=https://login.microsoftonline.com/<tenant-id>/v2.0 which works with idtoken. But my frontend sends accesstoken to backend. The result was 401: unauthorized.
It must be quarkus.oidc.auth-server-url=https://sts.windows.net/<tenant-id> which accepts access-token.

[sberyozkin]

@dkoci Right, this is because the access token provided by Azure is binary (not JWT), if it were in JWT format then it would work as well.
https://login.microsoftonline.com/<tenant-id>/v2.0 would work if Quarkus itself were doing the code flow.
I did not know that quarkus.oidc.auth-server-url=https://sts.windows.net/<tenant-id> is where one can verify the opaque binary Azure tokens, it is a useful info which we can share with other Quarkus Azure users, thanks

[dkoci]

I found what was wrong. In my previous app I tested role based access. Had quarkus.oidc.roles.role-claim-path=roles in application.properties (default is groups, but azure uses roles so we have to tell quarkus to use roles instead of groups). I had to remove this line from application.properties because there were no roles field in token.

[dkoci]

Have another problem :) Health probe gives me an error: Error processing Health Checks: io.quarkus.security.UnauthorizedException
There is also some strange health check added: <package_name>.health.ReadinesProbe_ClientProxy
Is there any way to disable authentication for health checks?

[sberyozkin]

Np, it would make sense to keep this thread to Azure specific queries, but indeed, you can permit all /q/* queries:

quarkus.http.auth.permission.public.paths=/q/*
quarkus.http.auth.permission.public.policy=permit

See https://quarkus.io/guides/security-authorization

[dkoci]

Not working. The problem is my health check calls some method which has restricted access.

[sberyozkin]

In that case it does not matter whether it is a health check or not, it is about either requiring a protected access to a given method or not.
Unfortunately it is not possible to have the same method semi-secured - where one can check for permissions for all requests to this method but the health checks