Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Provide default OIDC static tenant resolver #32834

Closed
sberyozkin opened this issue Apr 21, 2023 · 1 comment · Fixed by #32864
Closed

Provide default OIDC static tenant resolver #32834

sberyozkin opened this issue Apr 21, 2023 · 1 comment · Fixed by #32864
Assignees
Labels
area/oidc kind/enhancement New feature or request
Milestone

Comments

@sberyozkin
Copy link
Member

Description

A typical case, when more than one social provider is configured in application.properties, is to start a login process with the last path segment containing the tenant name, for example, given these 2 tenant declarations:

quarkus.oidc.google.provider=google
quarkus.oidc.google.client-id=...
quarkus.oidc.google.credentials.secret=..

quarkus.oidc.github.provider=github
quarkus.oidc.github.client-id=...
quarkus.oidc.github.credentials.secret=..

The UI will offer Google and GitHub login options with URLs like /service/login/google, /service/login/github, etc, giving Quarkus a hint which social provider to use.

However, right now, a user has to register a custom TenantResolver which will just get the last path segment from the request path, and use it as a value of the tenant id, and then when the authenticated user returns accessing some application URL, a tenant id property can be checked in RequestContext since the tenant id is encoded in the session cookie. It is a fairly typical, boilerplate code.

It would be useful to provide such a logic by default if no custom TenantResolver is available.

Implementation ideas

If non-default OIDC tenants are configured but no TenantResolver is registered, provide a default resolution logic which will 1) check RoutingContext tenantId attribute - if it exists - the user is already authenticated, return it 2) otherwise get the last path segment and offer it as a tenant id.

@sberyozkin sberyozkin added the kind/enhancement New feature or request label Apr 21, 2023
@quarkus-bot
Copy link

quarkus-bot bot commented Apr 21, 2023

/cc @pedroigor (oidc)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/oidc kind/enhancement New feature or request
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant