Resolve Sec. Identity in RESTEasy Reactive when Proactive Auth disabled

[michalvavrik]

f ix #23547 for RESTEasy Reactive cases (e.g. the issue reproducer)

Disabling proactive authentication makes accessing the SecurityIdentity the blocking operation. In RR security checks for these of standard security annotations that requires access to SecurityIdentity (e.g. @RollesAllowed) are further up the handler chain then same checks run by Quarkus Security Runtime (io.quarkus.security.deployment.SecurityProcessor#registerSecurityInterceptors). Checks run in RR access SecurityIndentity by getDeferredIdentity (non-blocking), however in Quarkus Security the checks are using getIdentity. That leads to BlockingOperationNotAllowedException when running synchronously on IO thread. The quarkus-security-runtime-spi does not allow to disable security checks (that make sense from security point of view, but f.e io.quarkus.security.runtime.interceptor.check.RolesAllowedCheck is always run twice if successful), but as checks in RR always run first, this PR sets the identity there to make it available later in the chain.

[sberyozkin]

This looks fine, I'll check tomorrow with a clearer head, but it would be great if @stuartwdouglas could double check as well

[sberyozkin]

@michalvavrik Sorry for a delay and thanks for the quality PR, I left a couple of minor comments.

Can you also check the last paragraph in this doc section, will that still be required if an endpoint tries to access the injected SecurityIdentity ? Can you please update the test endpoint and get the name from the injected identity as well ?

Thanks

[michalvavrik]

Can you also check the last paragraph in this doc section, will that still be required if an endpoint tries to access the injected SecurityIdentity ?

It's still true except when following conditions are met:

1. RESTEasy Reactive is used
2. and SecurityIdentity is accessed from endpoint that is annotated by standard security annotation that also requires SecurityIdentity in order to perform security check (so f.e. not @PermitAll)
   The way I understand the SecurityConstrainer may cause BlockingOperationNotAllowedException  #23547 is that SecurityConstrainer is accessing SecurityIdentity in a blocking manner which leads to an exception in that special case. Judging from implementation (I might be wrong there), there is no other way when SecurityConstrainer may be used from RR, thus this PR fixes the issue for RR.

The article discusses the Quarkus Security in general (not just RR), but I've added explanatory note.

Can you please update the test endpoint and get the name from the injected identity as well ?

Done, good idea, thank you.

[sberyozkin]

@michalvavrik Thanks, can you please check the failing RESTEasy Reactve TCK test ? 500 is reported

[michalvavrik]

@sberyozkin I fixed typo and rebased onto the latest main - 500 is gone.

[quarkus-bot]

Failing Jobs - Building 513e44c

Status	Name	Step	Failures	Logs	Raw logs
✔️	JVM Tests - JDK 11
✖	JVM Tests - JDK 11 Windows	Build	Failures	Logs	Raw logs
✔️	JVM Tests - JDK 17

Full information is available in the Build summary check run.

Failures

⚙️ JVM Tests - JDK 11 Windows #

- Failing: extensions/mongodb-client/deployment 
! Skipped: extensions/liquibase-mongodb/deployment extensions/panache/mongodb-panache-common/deployment extensions/panache/mongodb-panache-kotlin/deployment and 8 more

📦 extensions/mongodb-client/deployment

✖ io.quarkus.mongodb.NamedMongoClientConfigTest. - More details - Source on GitHub

java.lang.RuntimeException: 
java.lang.RuntimeException: io.quarkus.builder.BuildException: Build failure: Build failed due to errors
	[error]: Build step io.quarkus.mongodb.deployment.DevServicesMongoProcessor#startMongo threw an exception: java.lang.RuntimeException: java.lang.IllegalStateException: Previous attempts to find a Docker environment failed. Will not retry. Please see logs and check configuration

✖ io.quarkus.mongodb.NamedReactiveMongoClientConfigTest. - More details - Source on GitHub

java.lang.RuntimeException: 
java.lang.RuntimeException: io.quarkus.builder.BuildException: Build failure: Build failed due to errors
	[error]: Build step io.quarkus.mongodb.deployment.DevServicesMongoProcessor#startMongo threw an exception: java.lang.RuntimeException: java.lang.IllegalStateException: Previous attempts to find a Docker environment failed. Will not retry. Please see logs and check configuration

[sberyozkin]

Thanks @michalvavrik