Is there a way to manually verify bearer token and get SecurityIdentity, UserInfo and JsonWebToken?

[SetoKaiba]

Is there a way to manually verify and get SecurityIdentity, UserInfo and JsonWebToken?
Websocket doesn't support custom header.

I know that there's a one time token way to match the rest and the websocket like the issue below.
#7414

But I'd like to know whether there's a direct way to get SecurityIdenity, UserInfo and JsonWebToken by bearer token? Because I'd like to pass the bearer token directly by websocket message.

[quarkus-bot[bot]]

/cc @sberyozkin (security)

[SetoKaiba]

It seems that there's a workaround here.
#27754

        var request = new TokenAuthenticationRequest(new AccessTokenCredential(accessToken));
        HttpSecurityUtils.setRoutingContextAttribute(request, new DummyRoutingContext());
        identityProviderManager
                .authenticate(request)
                .subscribe()
                .with(securityIdentity1 -> {
                    logger.info(securityIdentity1.getPrincipal());
                    logger.info(((JsonWebToken) securityIdentity1.getPrincipal()).getRawToken());
                    for (String role : securityIdentity1.getRoles()) {
                        logger.info(securityIdentity1.getRoles());
                    }
                }, (error) -> {
                    logger.warn("Failed to validate token", error);
                });

This issue is reported. But it seems there's no update for the injectable service.
#24069

OK. I can get UserInfo like this. But it uses reflection and it's a bit ugly. And also, it doesn't solve the multiple tenant problem.

        var field = TenantConfigContext.class.getDeclaredField("provider");
        field.setAccessible(true);
        ((OidcProvider) field.get(defaultTenantConfigResolver.getTenantConfigBean().getDefaultTenant())).
                getUserInfo(accessToken).subscribe().with(userInfo1 -> logger.info(userInfo1.getUserInfoString()));

[sberyozkin]

@SetoKaiba, smallrye-jwt and JWT parser can help with simple manual verification returning JsonWebToken: https://quarkus.io/guides/security-jwt#jwt-parser

But with quarkus-oidc it is not currently possible, looks like #24069 is what is needed to be fixed to support such cases

[SetoKaiba]

Thank you. I'm using the workaround from #27754 to get the JWT now. It does meet my need currently.