External OIDC RestClient Auth

Answered

Das ist eher eine Quarkus Frage. Wir haben eine externe Restclient, die über ein zweite Keycloak daten anbietet, die ich konsumieren muss.
Soweit ich sehe sind quarkus.oidc-client.* properties kann ich nur eine auth-url geben. Es gibt die Annotation @NamedOidcClient, aber ich sehe keine Implementation für ein RestClient.
Also
@NamedOidcClient("flex-api")
@RegisterRestClient("flex-api")
und dann in app properties
quarkus.oidc-client."flexam-api".auth-url:..

Habt ihr hier eine Implementation? Google hat mir nicht so gut geholfen. Es gibt mehrere solche Fragen in Stackoverflow die unbeantwortet sind.
https://stackoverflow.com/questions/73238604/how-to-assign-an-oidcclient-to-a-specific-restclient-in-quarkus
https://stackoverflow.com/questions/73472025/quarkus-restclient-with-oidc-authentification

  				
Posted 
	one year ago

					More
				  		
  Report
		
				Anand Natampalli
				
				75
					 × 3

Votes Newest

Answers

Hi, we are implementing multiple rest clients with different auth server using multi-tenancy and ClientRequestFilter for getting tokens.

https://quarkus.io/guides/security-openid-connect-multitenancy#quarkus-oidc_quarkus.oidc.named-tenants-additional-named-tenants

Create a filter implementing ClientRequestFilter as can be found here:
https://quarkus.io/guides/security-openid-connect-client-reference#named-oidc-clients

Configure multiple tenants in application.json/application.yaml.

And finally annotate your RestClient Interfaces to use this filter:

Example:

@RegisterRestClient(configKey = "keycloak")
@RegisterProvider(KeycloakOidcClientRequestFilter.class)
@Path("/clients")
public interface KeycloakClientsResource ...

cheers luke

 						
Posted 
	one year ago

					More
				  		
  Report
		
				Lucas Reeh
				
				108
					 × 4
					 Administrator

Thank you very much! I will try and get back :-)

— Anand Natampalli one year ago

This worked with client credentials flow. We have a new situation now, where I need to access the data with implicit flow. That implies that I need to login with a service account user. Do you have any tips for that?

— Anand Natampalli one year ago

Write your answer

1K Views

1 Answer

one year ago