Offline JWT token signature validation with quarkus-oidc

[cdhermann]

Is it possible to use quarkus-oidc with offline bearer token validation?

With offline validation I mean that quarkus-oidc doesn't try to contact for example Keycloak when starting up.

If this is possible, how do I set this up? My quarkus.oidc.application-type is service. Do I just have to set quarkus.oidc.public-key? As soon as quarkus.oidc.auth-server-url is set, it looks like the auth server is contacted on application startup - even if my app already has the public key that can be used for the validation of the JWT signature. Must quarkus.oidc.auth-server-url be omitted to enforce the offline validation of the token signature?

[quarkus-bot[bot]]

/cc @pedroigor (oidc), @sberyozkin (jwt,oidc)

[sberyozkin]

@cdhermann Yes, setting a quarkus.oidc.public-key only is enough, here is how I do in in the test:
https://github.com/quarkusio/quarkus/blob/main/integration-tests/oidc-tenancy/src/main/resources/application.properties#L109..L110

client-id should not be needed. quarkus-oidc is not really the best tool for such cases though, its purpose is to cooperate with OIDC providers, we just added this option to simplify testing without having to use a dedicated wiremock support (but if your goal is to test only then quarkus-test-oidc-server will provide a wiremock support).
You may want to try quarkus-smallrye-jwt as well if you do not need OIDC provider.

[cdhermann]

@sberyozkin thank you very much for pointing me to quarkus-test-oidc-server. I had quarkus-oidc there for convenience while testing (automated and acceptance by users on a test environment) against a Keycloak test setup that resembles the customer's setup.

[cdhermann]

Additionaly, I used quarkus-oidc to be able to read the roles from the token as mentioned in https://quarkus.io/guides/security-openid-connect#token-claims-and-securityidentity-roles
I wasn't quite sure if quarkus-smallrye-jwt can the deal with the way Keycloak passes roles. I think it just handles the groups claim

[sberyozkin]

@cdhermann Thanks, smallrye-jwt can handle custom roles paths, but quarkus-oidc makes it a bit easier to find roles in Keycloak tokens