如何配置 quarkus 自定义 HttpAuthenticationMechanism？

Question

我需要一个 static 机制来验证我的发件人知道 static 令牌。 该令牌被硬编码到发送系统中。

我的 API 有一个端点/webhook ，我需要在其中对其进行验证。

这个guides/security-customization给出了一个关于如何实现自定义机制的例子，所以我实现了这个：

@Singleton
public class FixedTokenAuthenticationMechanism implements HttpAuthenticationMechanism {

    @Override
    public Uni<SecurityIdentity> authenticate(RoutingContext context, IdentityProviderManager identityProviderManager) {
        String authHeader = context.request().headers().get("magic_header");
        if (authHeader == "magic_value")
        {
            return Uni.createFrom().optional(Optional.empty());
        }
        else
        {
            return Uni.createFrom().optional(Optional.empty());
        }
    }

    @Override
    public Uni<ChallengeData> getChallenge(RoutingContext context) {
        return null;
    }

    @Override
    public Set<Class<? extends AuthenticationRequest>> getCredentialTypes() {
        return Collections.singleton(AuthenticationRequest.class);
    }

    @Override
    public Uni<Boolean> sendChallenge(RoutingContext context) {
        return HttpAuthenticationMechanism.super.sendChallenge(context);
    }

    @Override
    public HttpCredentialTransport getCredentialTransport() {
        return HttpAuthenticationMechanism.super.getCredentialTransport();
    }

    @Override
    public Uni<HttpCredentialTransport> getCredentialTransport(RoutingContext context) {
        return HttpAuthenticationMechanism.super.getCredentialTransport(context);
    }

    @Override
    public int getPriority() {
        return HttpAuthenticationMechanism.super.getPriority();
    }
}

我不知道如何配置它以在应用程序属性中使用。

似乎有一个路径特定的身份验证机制的配置，我似乎无法工作。

我需要在aplication.properties中配置什么才能使用我不太安全的/webhook端点安全机制？

Answer 1

现在这个实现是不完整的，但是就基于路径的身份验证而言，你需要有一个像webhook这样的别名，你可以从配置中引用，参见https://github.com/quarkusio/quarkus/blob/ main/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/BasicAuthenticationMechanism.java#L198 （注意， basic是一个限定符）以及 class 的 rest 如何实现自定义机制。 委托给默认接口实现可能不会起作用

Answer 2

用户： Sergey Beryozkin让我走上了正确的轨道。

package org.eon.webhookingestor.receiver;

import io.quarkus.arc.Priority;
import io.quarkus.oidc.IdTokenCredential;
import io.quarkus.security.AuthenticationFailedException;
import io.quarkus.security.identity.IdentityProviderManager;
import io.quarkus.security.identity.SecurityIdentity;
import io.quarkus.security.identity.request.AuthenticationRequest;
import io.quarkus.security.identity.request.TokenAuthenticationRequest;
import io.quarkus.security.runtime.QuarkusPrincipal;
import io.quarkus.security.runtime.QuarkusSecurityIdentity;
import io.quarkus.vertx.http.runtime.security.ChallengeData;
import io.quarkus.vertx.http.runtime.security.HttpAuthenticationMechanism;
import io.quarkus.vertx.http.runtime.security.HttpCredentialTransport;
import io.smallrye.mutiny.Uni;
import io.vertx.ext.web.RoutingContext;

import javax.enterprise.inject.Alternative;
import javax.inject.Singleton;
import java.util.Collections;
import java.util.Set;

@Alternative
@Singleton
@Priority(900)
public class MagicAuthenticationMechanism implements HttpAuthenticationMechanism {

    //related docs:
    // https://quarkus.io/guides/security#security-architecture
    // https://quarkus.io/guides/security-customization
    //related so: https://stackoverflow.com/questions/73120309/quarkus-returning-empty-body-response-for-unauthorize
    // related on so:
    // https://stackoverflow.com/questions/74384603/how-to-configure-a-quarkus-custom-httpauthenticationmechanism
    // https://stackoverflow.com/questions/73120309/quarkus-returning-empty-body-response-for-unauthorize

    @Override
    public Uni<SecurityIdentity> authenticate(RoutingContext context, IdentityProviderManager identityProviderManager) {
        String magic_key = "magic_header";
        String header_value = context.request().headers().get(magic_key);
        String magic_value = "magic_value";
        if ( !magic_value.equals(header_value))
        {
            return Uni.createFrom().failure(new AuthenticationFailedException());
        }

        return Uni.createFrom().item(
                QuarkusSecurityIdentity.builder()
                        .setPrincipal(new QuarkusPrincipal(magic_key))
                        .addCredential(new IdTokenCredential(header_value))
                        .build());
    }

    @Override
    public Uni<ChallengeData> getChallenge(RoutingContext context) {
        //https://quarkus.io/guides/security-customization#dealing-with-more-than-one-httpauthenticationmechanism
        //If no credentials are provided then the mechanism specific challenge is created
        throw new RuntimeException ("no credentials were provided");
    }

    @Override
    public Set<Class<? extends AuthenticationRequest>> getCredentialTypes() {
        //needs to inherit from io.quarkus.security.identity.request.AuthenticationRequest
        return  Collections.singleton(TokenAuthenticationRequest.class);
    }

    @Override
    public Uni<Boolean> sendChallenge(RoutingContext context) {
        // a failed authentication will check if a challenge should be sent
        return Uni.createFrom().item(Boolean.FALSE);
    }

    @Override
    public Uni<HttpCredentialTransport> getCredentialTransport(RoutingContext context) {
        return Uni.createFrom().item(new HttpCredentialTransport(HttpCredentialTransport.Type.OTHER_HEADER, "magic"));
    }

    @Override
    public int getPriority() {
        return 900;
    }
}

与配置：

quarkus.http.auth.permission.magic.paths=/webhook
quarkus.http.auth.permission.magic.policy=authenticated
quarkus.http.auth.permission.magic.auth-mechanism=magic

导致在我的机器上运行的神奇身份验证。

在这一点上，我建议不要实施和使用它，因为 quarkus 身份验证对我来说是完全不可预测的，如果你阅读这篇文章，也许你也是如此。

建议对所有端点进行过度测试。