Quarkus OIDC with custom code flow and customize url for call to autorhize and the redirect -

[debu999]

Description

Hi All,
We have a need to use a internal OIDC provider.

We have few additional parameters in the oauth code flow, need to know how its done with quarkus-oidc.

request params in our initial authorization code request is

response_type
client_id
scope
redirect_uri
resource
prompt
Using the default code flow , i am not sure how the url is built and by which class thus need help to figure how we can customize the authorization code flow with custom request parameters.

Implementation ideas

allow hook to customize any number for request param in code flow and post calls.

[quarkus-bot[bot]]

/cc @pedroigor, @sberyozkin

[sberyozkin]

@debu999 Hi,

client_id, redirect_uri are set automatically
Use quarkus.oidc.authentication.scopes=a,b,c to set some extra scopes in addition to the default openid
All other parameters can be set with quarkus.oidc.authentication.extra-params, example:

quarkus.oidc.authentication.extra-params.prompt=consent
quarkus.oidc.authentication.extra-params.resource=...

Please experiment

[debu999]

Thanks. Let me try those today.

[sberyozkin]

@debu999 About to move it to Discussions - we can create Quarkus issues if some specific fixes are needed

[debu999]

Thanks @sberyozkin for the help. It makes the main call to our Provider but then code exchange fails. Is there anything to be done by us to handle the exchange. I though quarkus-oidc will automatically exchange the code with a access token.

[sberyozkin]

@debu999 Np, yes, it is expected to complete the exchange. Can you please enable the trace logging of io.quarkus.oidc.runtime.CodeAuthenticationMechanism, io.quarkus.oidc.runtime.OidcProvider, io.quarkus.oidc.runtime.OidcProviderClient:

quarkus.log.category."io.quarkus.oidc.runtime.CodeAuthenticationMechanism".level=TRACE
quarkus.log.category."io.quarkus.oidc.runtime.CodeAuthenticationMechanism".min-level=TRACE
quarkus.log.category."io.quarkus.oidc.runtime.OidcProvider".level=TRACE
quarkus.log.category."io.quarkus.oidc.runtime.OidcProvider".min-level=TRACE
quarkus.log.category."io.quarkus.oidc.runtime.OidcProviderClient".level=TRACE
quarkus.log.category."io.quarkus.oidc.runtime.OidcProviderClient".min-level=TRACE

(we'll try to make capturing the debug information easier soon)

and also check the provider log ?

[debu999]

@sberyozkin I was able to debug the issue caused.
There is one issue with User Info endpoint it is asking for audience mismatch so is there any way we can override the audience for user info endpoint and actual application.
In our use case user info is generic with urn:microsoft:userinfo as intended audience but the code flow makes it go to resource value which is audience for access token.
Please advise on this. Our userinfo is only accepting a generic audience. Can we have something to make separate audience for User Info and roles. All our roles are in accesstoken only.

[sberyozkin]

@debu999 good you've narrowed it down,

There is one issue with User Info endpoint it is asking for audience mismatch so is there any way we can override the audience for user info endpoint and actual application.

Can you clarify it please ? Do you mean that if you configure quarkus-oidc to request UserInfo from your provider then the provider returns an error because the access token which is used to request this UserInfo has the audience different to the one expected by the provider ? Or is it something else ?

[sberyozkin]

quarkus-oidc can be configured to verify the audience set in the token but that is all AFAIK when it comes to dealing with the audience.

quarkus-oidc will also use the discovered or manually configured user info endpoint URL to fetch the UserInfo

[debu999]

Yes, userinfo endpoint returns 401 as Audience in access token is not what userinfo is expecting.
Userinfo only exposes a opaque token with sub
So codeflow does not really need to depend on user info and the same we can pull from acess token.

[sberyozkin]

@debu999

Userinfo only exposes a opaque token with sub

What do you mean ? The user info endpoint does not return any tokens, it returns UserInfo, quarkus-oidc uses the access token which it got (alongside the id token) by exchanging the code for it with the token (not UserInfo) endpoint.

So codeflow does not really need to depend on user info and the same we can pull from acess token.

It does not - a user has to configure quarkus-oidc to request the user info if having ID and access tokens is not sufficient.
Are you configuring it to request UserInfo ?

I think that may be we are talking about the different things, please clarify again

[debu999]

quarkus.oidc.authentication.user-info-required=false
Thanks now I have one more thing to figure. issuer for idtoken and accesstoken are different so it silently fails.

[debu999]

our well know configuration have two issuers

- issuer
- access_token_issuer

Would this be taken as enhancement
we have just marked quarkus.oidc.token.issuer=any

[sberyozkin]

Perhaps when you say UserInfo you refer to IdToken and it is also an opaque token ? Even if it is the case you can configure quarkus-oidc to use the access token for the roles but then to get the extra info which is not available in the id token one need to request the user info...

[debu999]

I was going through the OidcIdentiyProvider and it seems we do the following
getUsrInfoUni -> newUserInfoUni(resolvedContext,accessToken)
-> resolvedContext.provider.getUserInfo(accessToken)
-> client.getuserInfo(accessToken)
-> This makes http call to userinfo endpoint and get 401 error in my case,can we customize the call to use a different token Thus the code flow breaks.
Is there a option to not go to the userInfo endpoint or have custom validation for user.
p.s. we use hybrid mode so both webapp and service will work.

[sberyozkin]

@debu999 I see, it can only happen if you have configured quarkus-oidc to require UserInfo, see:

https://github.com/quarkusio/quarkus/blob/main/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcIdentityProvider.java#L115

(in the earlier versions false is set as a default at the config level)

It should not trigger a user info request unless you have set quarkus.oidc.authentication.user-info-required=true, can you check please your config

[debu999]

@sberyozkin We have now written a small react hook which does call the system every 5min. If the token is expired it gets refreshed internally. There is no way to exchange and refresh access token if there is no refresh token. Our tokens are ~12 hour expiry so it will be rarely a concern in future.

[sberyozkin]

@debu999 Sure, what I meant is that doing it internally is not something quarkus-oidc can do with the refresh token.
I'm still not sure what you mean that the token gets refreshed internally - this access token has been returned with the code flow exchange from Azure and only Azure can issue a new access token... This is why I'm not sure what you mean

[debu999]

When user logs in first time code flow happens and the code token is exchanged with accesstoken. For all subsequent calls till expiry of access token works fine.. There is a async process which keeps pinging the server every 5 min. If the token has expired quarkus will invalidate the cookie and new code flow starts. This is handled with a small popup which opens and close and user does not even notice. It's handled by our UI app to make it transparent for user now. It's the only way we can do it since we do not have refresh token.

[sberyozkin]

@debu999 Oh I see, so you mean the user is re-authenticated with another round of the code flow, makes sense

[debu999]

Yes. Is there anything we can do similar for devui and health ui.
Unfortunately we just reload the page when that happens for now. Not a blocker at the moment these are for are and technology.