quarkusio / quarkus

Quarkus: Supersonic Subatomic Java.
https://quarkus.io
Apache License 2.0
13.73k stars 2.67k forks source link

Make Keycloak dev service independent of OIDC extension #43086

Closed lebesis closed 2 weeks ago

lebesis commented 1 month ago

Description

Scenario: A Microservice receives requests that don't use OIDC (unauthenticated or authenticated through a different/external mechanism), then creates requests through a client towards an OIDC-protected service.

In this case, if the user only adds quarkus-oidc-client and quarkus-rest-client-oidc-filter, the keycloak dev service is not enable. On the other hand, if they add quarkus-oidc as well, then OIDC authentication is enabled for all resources by default.

To work around this, the user can use quarkus.http.auth.proactive=false, as mentioned in this discussion. This, however is not clear from the documentation and it is an extra step, which makes it counter-intuitive. The user also has to switch the oidc extension off for the final jar and even doing so, the extension is still going to be bundled with the executable.

Enabling the dev service without requiring the quarkus-oidc package will in my opinion improve the development experience, so please consider this request.

Implementation ideas

The Dev service could be made into a separate package and included by both quarkus-oidc and quarkus-oidc-client in case they are used separately.

quarkus-bot[bot] commented 1 month ago

/cc @geoand (devservices), @pedroigor (keycloak,oidc), @sberyozkin (keycloak,oidc), @stuartwdouglas (devservices)