Quarkus の認証メカニズム

package org.acme.http.security;

import io.quarkus.vertx.http.security.Form;
import io.quarkus.vertx.http.security.HttpSecurity;
import jakarta.enterprise.event.Observes;

public class FormConfiguration {

    void configure(@Observes HttpSecurity httpSecurity) {   (1)
        httpSecurity.mechanism(Form.builder()
                .httpOnlyCookie()
                .loginPage("/my-login.html")
                .errorPage("/my-error.html")
                .build());
    }

}

quarkus.http.ssl.certificate.key-store-file=server-keystore.jks
quarkus.http.ssl.certificate.key-store-password=the_key_store_secret
quarkus.http.ssl.certificate.trust-store-file=server-truststore.jks
quarkus.http.ssl.certificate.trust-store-password=the_trust_store_secret
quarkus.http.ssl.client-auth=required
quarkus.http.insecure-requests=disabled

quarkus.http.auth.certificate-role-properties=cert-role-mappings.properties (1)

quarkus.http.auth.permission.certauthenticated.paths=/*   (2)
quarkus.http.auth.permission.certauthenticated.policy=role-policy-cert (2)
quarkus.http.auth.policy.role-policy-cert.roles-allowed=user,admin     (2)

quarkus.tls.tls-config-1.key-store.p12.path=server-keystore.p12
quarkus.tls.tls-config-1.key-store.p12.password=the_key_store_secret
quarkus.tls.tls-config-1.trust-store.p12.path=server-truststore.p12
quarkus.tls.tls-config-1.trust-store.p12.password=the_trust_store_secret
quarkus.http.ssl.client-auth=required   (1)
quarkus.http.tls-configuration-name=tls-config-1    (2)

package org.acme.http.security;

import io.quarkus.tls.BaseTlsConfiguration;
import io.vertx.core.net.KeyCertOptions;
import io.vertx.core.net.KeyStoreOptions;
import io.vertx.core.net.SSLOptions;
import io.vertx.core.net.TrustOptions;

import java.util.Set;
import java.util.concurrent.TimeUnit;

public class MyTlsConfiguration extends BaseTlsConfiguration {

    @Override
    public KeyCertOptions getKeyStoreOptions() {
        return new KeyStoreOptions()
                .setPath("/tmp/certs/server-keystore.p12")
                .setPassword("the_key_store_secret")
                .setType("PKCS12");
    }

    @Override
    public TrustOptions getTrustStoreOptions() {
        return new KeyStoreOptions()
                .setPath("/tmp/certs/server-truststore.jks")
                .setPassword("the_trust_store_secret")
                .setType("PKCS12");
    }

    @Override
    public SSLOptions getSSLOptions() {
        SSLOptions options = new SSLOptions();
        options.setKeyCertOptions(getKeyStoreOptions());
        options.setTrustOptions(getTrustStoreOptions());
        options.setSslHandshakeTimeoutUnit(TimeUnit.SECONDS);
        options.setSslHandshakeTimeout(10);
        options.setEnabledSecureTransportProtocols(Set.of("TLSv1.3", "TLSv1.2"));
        return options;
    }

}

package org.acme.http.security;

import io.quarkus.vertx.http.security.HttpSecurity;
import jakarta.enterprise.event.Observes;

public class MutualTlsClientAuthConfig {

    void configure(@Observes HttpSecurity httpSecurity) {
        httpSecurity.mTLS("tls-config-1", new MyTlsConfiguration());    (1)
    }

}

quarkus.tls.tls-config-1.key-store.p12.path=server-keystore.p12
quarkus.tls.tls-config-1.key-store.p12.password=the_key_store_secret
quarkus.tls.tls-config-1.trust-store.p12.path=server-truststore.p12
quarkus.tls.tls-config-1.trust-store.p12.password=the_trust_store_secret
quarkus.http.ssl.client-auth=required
quarkus.http.tls-configuration-name=tls-config-1
quarkus.http.auth.certificate-role-properties=cert-role-mappings.properties

package org.acme.http.security;

import io.quarkus.vertx.http.security.MTLS;
import io.quarkus.vertx.http.security.HttpSecurity;
import jakarta.enterprise.event.Observes;

public class MutualTlsClientAuthConfig {

    void configure(@Observes HttpSecurity httpSecurity) {
        httpSecurity.mTLS(MTLS.builder()
                .tls("tls-config-1", new MyTlsConfiguration())
                .rolesMapping("CN-value", "user", "admin")
                .build());
    }

}

quarkus.http.tls-configuration-name=tls-config-1
quarkus.tls.tls-config-1.key-store.p12.path=server-keystore.p12
quarkus.tls.tls-config-1.key-store.p12.password=the_key_store_secret
quarkus.tls.tls-config-1.trust-store.p12.path=server-truststore.jks
quarkus.tls.tls-config-1.trust-store.p12.password=the_trust_store_secret

package org.acme.http.security;

import io.quarkus.vertx.http.security.HttpSecurity;
import io.quarkus.vertx.http.security.MTLS;
import jakarta.enterprise.event.Observes;

import java.util.Set;

public class MutualTlsClientAuthConfig {

    void configure(@Observes HttpSecurity httpSecurity) {
        httpSecurity.mTLS(MTLS.builder()
                .certificateToRolesMapper(x509Certificate -> {   (1)
                    final Set<String> securityIdentityRoles;

                    // replace this logic with your own certificate to roles mapping
                    if (x509Certificate.getIssuerX500Principal() != null
                            && "CN=quarkus.io".equals(x509Certificate.getIssuerX500Principal().getName())) {
                        securityIdentityRoles = Set.of("admin");
                    } else {
                        securityIdentityRoles = Set.of();
                    }
                    return securityIdentityRoles;
                })
                .build());
    }

}

package org.acme.security;

import jakarta.annotation.security.RolesAllowed;
import jakarta.enterprise.context.ApplicationScoped;

@ApplicationScoped
class DataService {

    @RolesAllowed("admin")  (1)
    void deleteEntity(Long entityId) {
        // business logic
    }

}

package org.acme.security;

import io.quarkus.security.PermissionChecker;
import io.quarkus.security.PermissionsAllowed;
import io.quarkus.security.identity.SecurityIdentity;
import io.quarkus.vertx.http.runtime.security.HttpSecurityUtils;
import jakarta.enterprise.context.ApplicationScoped;

@ApplicationScoped
class DataService {

    @PermissionsAllowed("canDeleteEntity")
    void deleteEntity(Long entityId) {
        // business logic
    }

    @PermissionChecker("canDeleteEntity")
    boolean canDeleteEntity(SecurityIdentity firstIdentity) {
        var allSecurityIdentities = HttpSecurityUtils.getSecurityIdentities(firstIdentity);
        if (allSecurityIdentities != null) {
            for (SecurityIdentity identity : allSecurityIdentities.values()) {
                if (identity.hasRole("admin")) {
                    return true;
                }
            }
        }

        return false;
    }

}

quarkus.http.auth.permission.basic.paths=/hello/basic (1)
quarkus.http.auth.permission.basic.policy=authenticated
quarkus.http.auth.permission.basic.auth-mechanism=basic

quarkus.http.auth.permission.bearer.paths=/hello/bearer (2)
quarkus.http.auth.permission.bearer.policy=authenticated
quarkus.http.auth.permission.bearer.auth-mechanism=bearer

quarkus.http.auth.permission.custom.paths=/hello/custom (3)
quarkus.http.auth.permission.custom.policy=authenticated
quarkus.http.auth.permission.custom.auth-mechanism=custom

quarkus.http.auth.permission.basic-bearer.paths=/hello/basic-bearer (4)
quarkus.http.auth.permission.basic-bearer.policy=authenticated
quarkus.http.auth.permission.basic-bearer.auth-mechanism=basic,bearer

quarkus.http.auth.inclusive=true

quarkus.http.auth.permission.basic-bearer.paths=/hello/basic-bearer
quarkus.http.auth.permission.basic-bearer.policy=authenticated
quarkus.http.auth.permission.basic-bearer.auth-mechanism=basic,bearer   (1)

quarkus.http.auth.inclusive=true
quarkus.http.auth.inclusive-mode=lax

quarkus.http.auth.permission.basic-bearer.paths=/hello/basic-bearer
quarkus.http.auth.permission.basic-bearer.policy=authenticated
quarkus.http.auth.permission.basic-bearer.auth-mechanism=basic,bearer   (1)

quarkus.http.auth.proactive=false

import io.quarkus.oidc.AuthorizationCodeFlow;
import io.quarkus.vertx.http.runtime.security.annotation.BasicAuthentication;
import jakarta.annotation.security.RolesAllowed;
import jakarta.ws.rs.GET;
import jakarta.ws.rs.Path;

@Path("hello")
public class HelloResource {

    @GET
    @BasicAuthentication (1) (2)
    @Path("basic")
    public String basicAuthMechanism() {
        return "basic";
    }

    @GET
    @RolesAllowed("admin") (3)
    @AuthorizationCodeFlow (4)
    @Path("code-flow")
    public String codeFlowAuthMechanism() {
        return "code-flow";
    }

    @GET
    @HttpAuthenticationMechanism("custom") (5) (6)
    @Path("custom")
    public String customAuthMechanism() {
        return "custom";
    }

    @GET
    @BasicAuthentication
    @AuthorizationCodeFlow
    @Path("basic-or-code-flow")
    public String basicOrCodeFlowAuthMechanism() {  (7)
        return "basic-or-code-flow";
    }
}

quarkus.http.auth.inclusive=true
quarkus.http.auth.proactive=false

package org.acme.http.security;

import io.quarkus.oidc.AuthorizationCodeFlow;
import io.quarkus.vertx.http.runtime.security.annotation.BasicAuthentication;
import jakarta.ws.rs.GET;
import jakarta.ws.rs.Path;

@BasicAuthentication
@AuthorizationCodeFlow
@Path("hello")
public class HelloResource {

    @GET
    @Path("basic-and-code-flow")
    public String basicAndCodeFlowAuthMechanism() {  (1)
        return "basic-and-code-flow";
    }
}

quarkus.http.auth.inclusive=true
quarkus.http.auth.inclusive-mode=lax
quarkus.http.auth.proactive=false

package org.acme.http.security;

import io.quarkus.oidc.AuthorizationCodeFlow;
import io.quarkus.vertx.http.runtime.security.annotation.BasicAuthentication;
import jakarta.ws.rs.GET;
import jakarta.ws.rs.Path;

@BasicAuthentication
@AuthorizationCodeFlow
@Path("hello")
public class HelloResource {

    @GET
    @Path("basic-and-code-flow")
    public String basicAndCodeFlowAuthMechanism() {  (1)
        return "basic-and-code-flow";
    }
}

quarkus.http.auth.inclusive-mode=lax (1)
quarkus.http.auth.inclusive=true

import io.quarkus.security.PermissionChecker;
import io.quarkus.security.PermissionsAllowed;
import io.quarkus.security.identity.SecurityIdentity;
import io.quarkus.vertx.http.runtime.security.HttpSecurityUtils;
import jakarta.ws.rs.GET;
import jakarta.ws.rs.Path;

import java.util.Map;

@Path("/hello")
public class HelloResource {

    @PermissionsAllowed("mtls-basic")
    @GET
    public String hello() {
        return "Hello world";
    }

    @PermissionChecker("mtls-basic")
    boolean isMtlsAndBasicAuthentication(SecurityIdentity identity) {
        Map<String, SecurityIdentity> identities = HttpSecurityUtils.getSecurityIdentities(identity);
        if (identities != null) {
            return identities.containsKey("basic") && identities.containsKey("x509"); (1)
        }
        return false;
    }
}

quarkus.http.auth.policy.roles1.roles-allowed=user
quarkus.http.auth.permission.roles1.paths=/hello/code-flow
quarkus.http.auth.permission.roles1.applies-to=JAXRS (1)
quarkus.http.auth.permission.roles1.policy=roles1
quarkus.http.auth.permission.roles1.methods=GET (2)