About disabling security

[Angel0926]

quarkus.oauth2.enabled or disable:authorization doesn't seem to work i receive the below error. java.lang.RuntimeException: java.lang.RuntimeException: io.quarkus.builder.BuildException: Build failure: Build failed due to errors [error]: Build step io.quarkus.arc.deployment.ArcProcessor#validate threw an exception: javax.enterprise.inject.spi.DeploymentException: Found 4 deployment problems: [1] Ambiguous dependencies for type io.quarkus.security.spi.runtime.AuthorizationController and qualifiers [@default] - java member: io.quarkus.vertx.http.runtime.security.HttpAuthorizer():controller - declared on CLASS bean [types=[io.quarkus.vertx.http.runtime.security.HttpAuthorizer, java.lang.Object], qualifiers[@default, @Any], target=io.quarkus.vertx.http.runtime.security.HttpAuthorizer] - available beans: - CLASS bean [types=[io.quarkus.security.spi.runtime.AuthorizationController, com.aligntech.cs.treatcanaryapi.security.DisabledAuthController, java.lang.Object], qualifiers=[@default, @Any], target=com.aligntech.cs.treatcanaryapi.security.DisabledAuthController] - CLASS bean [types=[io.quarkus.test.security.TestAuthController, io.quarkus.security.spi.runtime.AuthorizationController, java.lang.Object], qualifiers=[@default, @Any], target=io.quarkus.test.security.TestAuthController] - CLASS bean [types=[io.quarkus.security.spi.runtime.AuthorizationController, java.lang.Object], qualifiers=[@default, @Any], target=io.quarkus.security.spi.runtime.AuthorizationController]

[quarkus-bot[bot]]

/cc @sberyozkin

[sberyozkin]

@Angel0926 , please provide a reproducer, hard to comment on the exception stack trace alone

[Angel0926]

i create a userinfo controller.

@Slf4j
@Authenticated
@Path("/")
public class UserInfoController{
@Inject
 SecurityIdentity securityIdentity; 


@GET @Path("/userinfo")
@Produces(MediaType.APPLICATION_JSON)

public Uni<Response> getUserInfo() {

 return Uni.createFrom().item(() -> Response.ok(new UserInfo(securityIdentity.getPrincipal().getName(),securityIdentity.getRoles())).build()); } 

[Angel0926]

@test
@testsecurity(user = "[email protected]", roles = "USER")
public void testOidcWithClaimsUserInfoAndMetadata() {
var expectedResponseBody = jsonContent(sampleResponseFile("get-token-responce-username-and-role.json")); RestAssured.when()
.get("/userinfo")
.then()
.body("",equalTo(expectedResponseBody.getRootMap()));}

[sberyozkin]

@Angel0926 If you could add a zip containing your test project or create a github project then it would help, we have tests involving these type of test annotations, so hard to suggest anything concrete.

Looks like com.aligntech.cs.treatcanaryapi.security.DisabledAuthController is interfering, can you remove it please and try again ? It may need to be registered as an alternative bean to avoid the CDI ambiguities

[Angel0926]

Yes when i remove com.aligntech.cs.treatcanaryapi.security.DisabledAuthController the project is run. why i may registered as an alternative bean to avoid the CDI ambiguities?
give me please link or say where i see

[sberyozkin]

Please try as shown here, https://quarkus.io/guides/security-customization#disabling-authorization

If that does not help then probably the best thing to do is not to add com.aligntech.cs.treatcanaryapi.security.DisabledAuthController while testing as this type controller is meant to replace the default one and optionally disable the authorization, and the role of the Test authorization controller is similar, replace the default one and customize it

[Angel0926]

Thanks a lot. I remove this controller