Link to external service (eg. Microsoft) using oidc

[luca-bassoricci]

In our system we have an user entity defined with the usual informations attached (name, login, etc...).
Now I need to ask users to link this internal account with their Microsoft account because we should be able to send mails using a backend job via outlook API using the generated access-token during the account link process.
I'm looking at oidc extension, but I haven't found any way to start the authorization code flow programmatically; is there any way to do that or the oidc components are tied to quarkus authorization mechanism and can't be used as a standalone component?

Regards
Luca

[quarkus-bot[bot]]

/cc @pedroigor (oidc), @sberyozkin (oidc)

[sberyozkin]

Hi @luca-bassoricci

I think you need to use JAX-RS to redirect users to the endpoint like /link which is protected by quarkus-oidc and it will trigger the authorization code flow and in your /link endpoint you can have REST client set up which will propagate the linked access token to Outlook etc.

How it the current endpoint from where you need to initiate the code flow from is secured ? Is it also protected by quarkus-oidc or some other authentication mechanism is used, such as basic authentication ?

If it is also secured by OIDC then you'll need to create 2 tenants: https://quarkus.io/guides/security-openid-connect-multitenancy#static-tenant-resolution, one would manage this endpoint's authentication, another one - the link process, lets say at /service and /link respectively. Resolve the tenant configuration using one of the 3 documented options. The only trick is to restrict the session cookie per tenant, for example, quarkus.oidc.authentication.cookie-path=/service, quarkus.oidc.authentication.cookie-path=/link .

If the first endpoint is basic auth then simply configure both basic and OIDC authentication but restrict /service to basic and /link to code:

https://quarkus.io/guides/security-authentication-mechanisms#path-specific-authentication-mechanisms

quarkus.http.auth.permission.basic.paths=/service
quarkus.http.auth.permission.basic.policy=authenticated
quarkus.http.auth.permission.basic.auth-mechanism=basic

quarkus.http.auth.permission.code.paths=/list
quarkus.http.auth.permission.code.policy=authenticated
quarkus.http.auth.permission.code.auth-mechanism=code

Does it help ?

[sberyozkin]

@luca-bassoricci If you do need to control it manually, then the following test code might be of interest:

1. Initiate the redirect to the OIDC provider, https://github.com/quarkusio/quarkus/blob/main/integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/UnprotectedResource.java#L61
2. Use quarkus-oidc-client to compete the flow in the callback method:
   https://github.com/quarkusio/quarkus/blob/main/integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/UnprotectedResource.java#L50

[luca-bassoricci]

@sberyozkin I will take a look to examples tomorrow but seems to be what I was looking for.
Thanks for your help, I really appreciated it 🙂

[sberyozkin]

Np, let us know how it works out, thanks

[luca-bassoricci]

The code from examples is exactly what I need and works fine.
A couple of years ago I had to solve the same problem but I prefered to use Scrivejava but this time I'll use Quarkus OIDC support.

[sberyozkin]

@luca-bassoricci Glad it worked - if you have some suggestions about what can be simplified - please let us know, cheers