How to secure WebSocket connection when using Keycloak / OIDC

[flowt-au]

Hi.
I have posted a detailed question on SO, have had no response and I am desperate to find the answer. I also responded to this answer in the Quarkus Issues section which is very close, I think, but again no response yet.

The Quarkus docs seem to be silent on this and I am hoping that someone who has done this can fill in the missing piece of this puzzle.

I apologise for the cross-posting but I have been stuck for days on this and my newness to Quarkus and the apparent gap in the docs is getting the better of me. I suspect the answer is in the docs somewhere but I am confused by the number of options and pathways.

Thanks,
Murray

[quarkus-bot[bot]]

/cc @pedroigor (keycloak,oidc), @sberyozkin (keycloak,oidc)

[sberyozkin]

Hi @flowt-au I think the solution offered at #29919 should be enough, and it is worth asking questions there, hopefully the reporter will provide a reproducer. FYI, no standard solution available to support carrying the sticky token over WS bindings.

I'd recommend you to start with simply creating a hello world reactive route first, just to get the base thing right, without WS, plain HTTP, https://quarkus.io/guides/reactive-routes.

Next try to enhance it as suggested #29919. FYI, I'm not a WS expert, so if I were to find a solution I'd do the same, get the basic thing working and then try to enhance it to support WS.

[sberyozkin]

@flowt-au Try to add @Blocking to the method which causes this exception

[sberyozkin]

@flowt-au Or, if you'd like to avoid blocking it, see the note related to it in https://quarkus.io/guides/security-built-in-authentication-support-concept#proactive-authentication

[flowt-au]

Thanks again @sberyozkin:
I tried the @Blocking again and as previously discovered it throws the error below.
eg

@OnOpen
@Blocking
public void onOpen(Session session, @PathParam("clientid") String clientid) {
    Log.info("websocket onOpen session=" + session.getId());
}

io.quarkus.runtime.BlockingOperationNotAllowedException: 
Blocking security check attempted in code running on the event loop. 
Make the secured method return an async type, i.e. Uni, Multi or CompletionStage, or use an authentication mechanism that sets the SecurityIdentity in a blocking manner prior to delegating the call

So, that is why I tried making the onOpen() return a Uni which lead me to needing to ask the question in SO. ie

1. If I make the onOpen() return a Uni, how do I subscribe to it so it runs?
2. Can I still access the JWT to get the claims I need?

And yes, I had read the proactive-authentication docs, and what I am looking for is an example of how to implement that approach, if indeed that will even work in this WebSocket context.

Just to respond to your suggestions: I have read everything I can find and attempted to implement what I have found. I also asked @RoMiRoSSaN to expand upon their post in #29919 which starts with the words For other peaople who need auth in WS, asking if they could provide an example of the onOpen() and onMessage() methods they used which works with the rest of the code they provided. I also tried to find a PR you suggested @RoMiRoSSaN to make in your responses in #29919 but there doesn't seem to be one.

I could make a long post detailing all the things I have tried but reasoned that would not be helpful.

So, my question is: Given there are others who have successfully secured their WebSockets with Quarkus (eg @RoMiRoSSaN), and, as you say, there is no standard solution, nor any docs, I was hoping someone could tell me how they did it.

Thanks again,
Murray

[sberyozkin]

@flowt-au The hint is here: To work around this you need to @Inject an instance of io.quarkus.security.identity.CurrentIdentityAssociation, and call the Uni<SecurityIdentity> getDeferredIdentity(); method. You can then subscribe to the resulting Uni and will be notified when authentication is complete and the identity is available.

Not sure it works with webSockets, but you need to have a Uni<Void> return type, then .subscribe to getDeferredIdentity(), see the example how subscribe is done here:

quarkus/extensions/oidc-client-reactive-filter/runtime/src/main/java/io/quarkus/oidc/client/reactive/filter/runtime/AbstractOidcClientRequestReactiveFilter.java

Line 32 in 7fda265

super.getTokens().subscribe().with(new Consumer<>() {

, and once securityIdentity is available you can then check what is needed, and complete the request with returning Uni<Void>.

Perhaps it is also worth trying disabling the proactive authentication and see what happens

[flowt-au]

Ok, thanks. I think I am missing something in my understanding of Mutiny here. I have only been coding in Java for a few of months so my expertise is not high, yet.

Taking the security aspects out of the equation for a minute, if my onOpen() method returns a Uni, then my understanding is that there needs to be a subscriber to the onOpen() method or it will not run.

So, with this simplest of tests, onOpen() wont run because nothing is subscribed to it. ie the Log.info() message is not in the terminal.

@OnOpen
public Uni<Void> onOpen(Session session, @PathParam("clientid") String clientid) {
    Log.info("websocket onOpen session=" + session.getId());
    return Uni.createFrom().voidItem();
}

With a RestEasy endpoint, there is a subscriber to the Uni somewhere in the RestEasy chain:

@GET
public Uni<Response> getData(Request request) {
    return Uni.createFrom().item("{blah blah}")
          .onItem()
          .transform(item -> item != "" ? Response.ok(item) : Response.status(Response.Status.NO_CONTENT))
          .onItem()
          .transform(Response.ResponseBuilder::build);
}

In my WS example above there is no such subscriber, so somehow I would need to make one.

I am guessing that is your point regarding super.getTokens().subscribe().with(new Consumer<>() { }. Are you saying I would need to build something like the AbstractOidcClientRequestReactiveFilter but for WebSockets?

Following your suggestion I tried

@OnOpen
public Uni<Void> onOpen(Session session, @PathParam("clientid") String clientid) {
    Log.info("websocket onOpen session=" + session.getId());
    
    return identities.getDeferredIdentity()
    .onItem()
    .transformToUni(identity -> {
        // Just to see if we reach here
        Log.info("identity=" + identity.toString());
        return Uni.createFrom().voidItem();
    });
}

but, of course, the same issue applies as per my simple example above - there is no subscriber, so onOpen() never runs.

Is there a place in Quarkus I can offer to employ someone to write this since it seems it is way beyond my expertise at the moment?

Thanks again,
Murray

[sberyozkin]

@flowt-au Have a closer look at the code I linked to, you need to .subscribe().with(...) to Uni returned from getDeferredIdentity.
You'll need to acquire Red Hat Build of Quarkus to have a dedicated support, if you are already a customer then please get in touch with the support team.

[flowt-au]

OK. Thanks for your patience. I will look again.

[flowt-au]

Sorry @sberyozkin, I am not understanding this at all. I have debugged my way through the Quarkus code to try to understand what should be happening, reread the docs, taken a closer look at the code you linked to, and I am still confused.

As you point out I need to follow this hint:

To work around this you need to @Inject an instance of io.quarkus.security.identity.CurrentIdentityAssociation, and call the Uni<SecurityIdentity> getDeferredIdentity(); method. You can then subscribe to the resulting Uni and will be notified when authentication is complete and the identity is available.

In response to my previous reply, with my sample as per below, you said to Have a closer look at the code I linked to, which I have done and I still cannot understand how to implement that in my class.

Clearly my attempt doesn't work - onItem() is never executed, so I assume this is not what you mean:

@Authenticated
@ServerEndpoint(value = "/services/{clientid}", configurator = WebSocketSecurityConfigurator.class)
public class WebSocketGateway {

    @Inject
    SecurityIdentity securityIdentity;

    @Inject
    CurrentIdentityAssociation identities;

    @OnOpen
    public Uni<Void> onOpen(Session session, @PathParam("clientid") String clientid) {
        Log.info("websocket onOpen session=" + session.getId());

        return identities.getDeferredIdentity()
                .onItem()
                .transformToUni(identity -> {
                    // Just to see if we reach here
                    Log.info("identity=" + identity.toString());
                    return Uni.createFrom().voidItem();
                });
    }
}

I gather what you and the docs suggest is only a couple of lines of code. Is there any chance you could provide an example of what you mean using my class above please?

Thanks again,
Murray

[sberyozkin]

@flowt-au I did try to highlight twice how to subscribe to the entity, why you are keeping using getDeferredEntity().onItem() ?
FYI, I meant something like this:

identities.getDeferredIdentity().subscribe().with(new Consumer<>() {
            @Override
            public void accept(SecurityIdentity identity) {
                ...
            }
        }, new Consumer<>() {
            @Override
            public void accept(Throwable t) {
                ...
            }
        });

You might not even need to return Uni<Void>, and just keep void method return type, needs to be experimented with.

Give it a try please, and perhaps it may also make sense to follow some Quarkus and Mutiny tutorials on how to work with Uni.

[sberyozkin]

@flowt-au I'll try to add a Quarkus test at some point, I can't prioritise immediately but I'll try, though I have no idea how to use HtmlUnit to test web sockets. If you'd like, please investigate creating a Quarkus integration test, HtmlUnit is used in the test code to test a hello world WS endpoint, without any security involved, and then I can try to enhance it to verify an OIDC token can be carried around in the WS flows.

[flowt-au]

@sberyozkin Thanks. I will get back to you once I have worked through all that.

[sberyozkin]

@flowt-au Np, sooner or later we will sort it out, I'm sorry I can't spend more time on this issue right now - but it looks like you are nearly there with the working solution