OIDC Multitenancy Always Resolves to Default #51493
MatthewThomasTiani
started this conversation in
Community
Replies: 2 comments 2 replies
-
|
@MatthewThomasTiani I'm not sure at the moment but it might be related to the the fact that Can you please make it a default tenant and the cognito one - |
Beta Was this translation helpful? Give feedback.
1 reply
-
|
@MatthewThomasTiani or perhaps the bug is to do with the fact that |
Beta Was this translation helpful? Give feedback.
-
|
Hi @sberyozkin, Here is the outputs for your suggested tests. swapping the default to be tenant-aConfig:When starting quarkus is dev mode I see that it does find the Cognito jwks and also it sees there is a Request with cognito tokenLooks happy, I see Request with local tokenNow this worked, which I did not expect. This suggests to me that is may still be failing on To test this further I will create a second "local" token with a public key configuration and add a Testing new tenant-b (3rd oidc option)I will just add the new tenant config and maintain the default as the local and tenant-a as cognito. ConfigHere is the logs of quarkus starting up with the updated config. We can see there are now 2 outputs for Request for tenant-bThis failed with a 401 - as you can see it selected the Named tenants only - no default configruationConfigI will return back to a two tenant config, one will be cognito, the other will be local. Here is the logs of quarkus starting up with the updated config. Request with local token (tenant-b)This looks very unhappy, in my response I get From my understanding, this did not attempt to verify the token as it could not match against any configured tenant and since there is no default configuration could not progress any further and then exits the workflow. Request with cognito token (tenant-a)this worked, I got a 200 response. I hope this helps clarify some points, please let me know if theres anything else I can do to test. Thanks! |
Beta Was this translation helpful? Give feedback.
1 reply
-
|
Thanks @MatthewThomasTiani , I opened the bug issue to investigate why the local tenant is not resolved correctly |
Beta Was this translation helpful? Give feedback.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
Hi, I am working through the guide oidc-multitenancy to attempt to set up a very simple REST API I can play with to further learn this extension. My goal is to have a local bearer token validator and also a AWS cognito token validator as this fits my customer requirement.
I am using the latest quarkus version
3.30.3. The configuration I have is as follows,When I start quarkus, the logs are as followsm
And then when I send a request with a token obtained from Cognito I see this,
Which makes absolute sense and works.
Then, when I obtain a token which is signed by the private key of
tenant-aI see this,It seems to suggest that it has not loaded the
tenant-aconfiguration and cannot route to the relevant config using the issuer.Can any offer any further advice?
Beta Was this translation helpful? Give feedback.
All reactions