Validating an Access Token with OIDC give NPE when running not in dev mode [Quarkus 3.21.4]

[dometec]

Hi Team, I have an Access Token and I want to verify it manually. I use TenantIdentityProvider as written in the documentation.

The problem is that, when I run the code with quarkud:dev, it works, otherwise I get a NPE:

Caused by: java.lang.NullPointerException: Cannot invoke "io.quarkus.oidc.runtime.OidcConfig.namedTenants()" because "config" is null
        at io.quarkus.oidc.runtime.OidcConfig.getDefaultTenant(OidcConfig.java:71)
        at io.quarkus.oidc.runtime.OidcRecorder$TenantSpecificOidcIdentityProvider.<init>(OidcRecorder.java:149)
        at io.quarkus.oidc.runtime.OidcRecorder$4.get(OidcRecorder.java:132)

I create a very simple project that demonstrates the problem: https://github.com/dometec/quarkus-iodc-test however all the code is shown below:

package testiodc;

import java.time.Duration;

import io.quarkus.oidc.AccessTokenCredential;
import io.quarkus.oidc.TenantIdentityProvider;
import io.quarkus.runtime.StartupEvent;
import io.quarkus.security.identity.SecurityIdentity;
import jakarta.enterprise.context.ApplicationScoped;
import jakarta.enterprise.event.Observes;
import jakarta.inject.Inject;

@ApplicationScoped
public class ApplicationLifecycleListener {

	@Inject
	TenantIdentityProvider identityProvider;

	public void init(@Observes StartupEvent ev) {

		AccessTokenCredential tokenCredential = new AccessTokenCredential("fakeaccesstoken");
		SecurityIdentity securityIdentity = identityProvider.authenticate(tokenCredential).await()
				.atMost(Duration.ofSeconds(30));

		System.out.println(securityIdentity);

	}

}

Any suggestion?

[quarkus-bot[bot]]

/cc @pedroigor (oidc), @sberyozkin (oidc)

[sberyozkin]

@dometec It is probably related to the fact you try to do it at the Startup time.

[dometec]

Hi @sberyozkin , no, I get the same result using an HTTP call. I updated the example:

import java.time.Duration;

import io.quarkus.oidc.AccessTokenCredential;
import io.quarkus.oidc.TenantIdentityProvider;
import io.quarkus.security.identity.SecurityIdentity;
import jakarta.inject.Inject;
import jakarta.ws.rs.GET;
import jakarta.ws.rs.Path;

@Path("/check")
public class Resource {

	@Inject
	TenantIdentityProvider identityProvider;

	@GET
	public void init() {

		AccessTokenCredential tokenCredential = new AccessTokenCredential("fakeaccesstoken");
		SecurityIdentity securityIdentity = identityProvider.authenticate(tokenCredential).await()
				.atMost(Duration.ofSeconds(30));

		System.out.println(securityIdentity);

	}

}

[sberyozkin]

Hi @dometec, but in your reproducer, there is nothing in the prod that specifies the OIDC configuration, We can try to get a better exception message to catch such cases, but in general you need some verification support available for this call to succeed

[sberyozkin]

@dometec It works in devmode with empty application.properties because Dev Services for Keycloak adds these properties pointing to the Keycloak container. To make it work in prod, you have to add Keycloak or other provider configuration, you can use %prod. prefix to avoid the prod properties interfering with the devmode

[dometec]

Thanks @sberyozkin for your help. I create the minimum project just to show the behaviours, adding a real keycloak configuration doesn't change anything. I pushed a real endpoint (so you can try) adding application.properties to the project:

quarkus.oidc.auth-server-url=https://meters.osys.it/auth/realms/WebChatDemo
quarkus.oidc.client-id=apiserver
quarkus.oidc.credentials.secret=${secret}
quarkus.oidc.application-type=service

[sberyozkin]

@dometec I've reproduced it, see #47568.

The workaround is to have the configuration in a custom tenant, for example:

quarkus.oidc.my-tenant.auth-server-url=https://meters.osys.it/auth/realms/WebChatDemo
quarkus.oidc.my-tenant.client-id=apiserver
quarkus.oidc.my-tenant.credentials.secret=${secret}

Thanks

[dometec]

Thanks, I add only that is need to use @Tenant on inject:

	@Tenant("my-tenant")
	@Inject
	TenantIdentityProvider identityProvider;