Help for security extension building

[smoothdub]

Hello,

I have to plug a quarkus application into a CAS server. Nothing existing match my expectations.
So I would like to build a quarkus extension that would do it. Unfortunately, after digging into the quarkus source code (especially the one from oidc-extension), I still have so many blocking points which are difficult to understand.

For instance, I do not understand clearly what I should send back every method of an HttpAuthenticationMechanism.

Is there someone who already works on a quarkus security extension who would be kind to answer my question during a call?

Thanks in advance!

[quarkus-bot[bot]]

/cc @sberyozkin (security)

[sberyozkin]

@smoothdub I can propose for you to request a new quarkus-cas extension be created in Quarkiverse (you will need to open an issue similar to #32485) and once it is approved and set up, you can open issues in the project and we can discuss things there. quarkus-oidc has grown to become quite complex, so it is not the best starting place.
You can copy and paste Quarkiverse Kerberos extension which is much simpler, and implement HttpAuthenticationMechanism and IdentityProvider following the pattern used there

[smoothdub]

@sberyozkin thanks for the advice. I'll give a look.

[smoothdub]

We are trying to understand why every place containing a lambda is written with a functional interface instead.
Like:

 return context.runBlocking(new Supplier<SecurityIdentity>() {
            @Override
            public SecurityIdentity get() {

                QuarkusSecurityIdentity.Builder builder = QuarkusSecurityIdentity.builder();
                return builder.build();
            }
        });

instead of

        return context.runBlocking(() -> {
            QuarkusSecurityIdentity.Builder builder = QuarkusSecurityIdentity.builder();
            return builder.build();
        });

Is it for a readability reason or because it is some legacy code?

[sberyozkin]

The code involving a lambda is considered to be generally slower compared to the explicit lambda coding (even if the difference can be negligible or none in some cases), but also for the readability reasons, but it is up to the extension implementers which style they may want to use.