@PermitAll is misleading

[MarcusBiel]

The @permitAll annotation is misleading and has cost me some effort to figure out its meaning -
perimit all implies that this opens up an endpoint for all requests - but what is actually meant is
@PermitAllRoles or @PermitAllExistingRoles or something like that.

[MarcusBiel]

@sberyozkin @emmanuelbernard

[emmanuelbernard]

So so I guess it's related to #10361 you tried to use @PermitAll for that. Maybe the doc improvement can segway the two points of clarifying Permit all and the section about a unauthenticated subpath

[MarcusBiel]

Sure

[sberyozkin]

Hi @MarcusBiel Can you clarify again please what exactly was misleading here ?
Both @PermitAllRoles and @PermitAllExistingRoles interpretations look identical to me :-), this is a standard annotation which has been around forever, I never really use it, but I guess it means: whatever roles, if any, the identity has will be sufficient for the @PermitAll annotated method be invoked, not really sure what Quarkus docs need to clarify

[MarcusBiel]

@sberyozkin as stated initially, @permitAll to me means that this method is open, permitted to EVERYONE, so like not authenticated. But it actually means permitted to all authenticated roles.

[stuartwdouglas]

So the issue here is that JAX-RS comes after the HTTP authentication layer. If you have configured HTTP level authentication then it will be run before the request has actually reached the JAX-RS layer.

We can't 'push up' the JAX-RS level constrains into the HTTP layer, because JAX-RS pre-matching filters can change the endpoint that the request is mapped to, so you can't be sure which endpoint will actually be invoked.

I am adding a quarkus.security.jaxrs.default-roles-allowed property that you can use to do what you are after. If you set quarkus.security.jaxrs.default-roles-allowed=** this will require authentication for every endpoint by default, but will be overridden by annotations if they are present.

[MarcusBiel]

@stuartwdouglas quarkus.security.jaxrs.default-roles-allowed - sounds like a great improvement, since my lisr of public paths (quarkus.http.auth.permission.public.paths=) is getting longer and longer. Any idea in which version this will be available?

[stuartwdouglas]

Should be 2.2