Prioritize OIDC mechanism when inclusive authentication is disabled to simplify using mTLS and OIDC together

[michalvavrik]

• I have raised mTLS authentication mechanism priority in Quarkus 3.16 when implementing inclusive authentication Support for two or more authentications for a single request #42935, that unfortunately means that mTLS mechanism runs before OIDC (it is natural order though). When users require mTLS and OIDC, they need to explicitly select OIDC or enable inclusive authentication. This PR restores original behavior when inclusive authentication is disabled.
• Motivation: https://quarkusio.zulipchat.com/#narrow/channel/187030-users/topic/Mtls.20with.20oidc
• The point is, when quarkus.http.ssl.client-auth=REQUIRED is set, Vert.x ensures mTLS and we can easily run only OIDC and some users relied on this behavior (judging by the Zulip communication).

[github-actions]

🙈 The PR is closed and the preview is expired.

[sberyozkin]

Hey @michalvavrik, thanks very much, it must've been myself who raised the MTLS priority in the old PR, so the breaking side-effect it is definitely not a consequence of your work, thanks in any case...

I'm having some unclear concerns, from one point of view, we are doing the totally right thing, we are restoring what used to work for users combining MTLS and OIDC, which used to work simply because MTLS, before 3.16, is sorted below OIDC.

What the inclusive authentication does it really makes, IMHO, the right thing, MTLS check must run first, to make it clear for users that in such cases, SecurityIdentity represents MTLS, this is the main thing, since the current MTLS authentication mechanism just wraps the client certificate - OIDC may access it directly from RoutingContext.

I guess now what I'm trying to say is that we should update the motivation text in the docs, that the reason it is sorted first when the inclusive authentication is on is to ensure that the injected SecurityIdentity is the one which represents the MTLS authentication, which technically, runs first at the transport level

[michalvavrik]

Sure Sergey.

[quarkus-bot]

Status for workflow Quarkus Documentation CI

This is the status report for running Quarkus Documentation CI on commit 671ed88.

✅ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

Warning

There are other workflow runs running, you probably need to wait for their status before merging.

[quarkus-bot]

Status for workflow Quarkus CI

This is the status report for running Quarkus CI on commit 671ed88.

Failing Jobs

Status	Name	Step	Failures	Logs	Raw logs	Build scan
✖	Native Tests - Windows support	Setup GraalVM	⚠️ Check →	Logs	Raw logs	🚧

You can consult the Develocity build scans.

---

Flaky tests - Develocity

⚙️ JVM Tests - JDK 17 Windows

📦 integration-tests/grpc-hibernate

✖ com.example.grpc.hibernate.BlockingRawTest.shouldAdd - History

• Condition with Lambda expression in com.example.grpc.hibernate.BlockingRawTestBase was not fulfilled within 30 seconds. - org.awaitility.core.ConditionTimeoutException

org.awaitility.core.ConditionTimeoutException: Condition with Lambda expression in com.example.grpc.hibernate.BlockingRawTestBase was not fulfilled within 30 seconds.
	at org.awaitility.core.ConditionAwaiter.await(ConditionAwaiter.java:167)
	at org.awaitility.core.CallableCondition.await(CallableCondition.java:78)
	at org.awaitility.core.CallableCondition.await(CallableCondition.java:26)
	at org.awaitility.core.ConditionFactory.until(ConditionFactory.java:1006)
	at org.awaitility.core.ConditionFactory.until(ConditionFactory.java:975)
	at com.example.grpc.hibernate.BlockingRawTestBase.shouldAdd(BlockingRawTestBase.java:59)
	at java.base/java.lang.reflect.Method.invoke(Method.java:569)

---

⚙️ Native Tests - Misc4

📦 integration-tests/gradle

✖ io.quarkus.gradle.nativeimage.CustomNativeTestSourceSetIT.runNativeTests - History

• Gradle build failed with exit code 1 - java.lang.AssertionError

java.lang.AssertionError: Gradle build failed with exit code 1
	at app//io.quarkus.gradle.QuarkusGradleWrapperTestBase.runGradleWrapper(QuarkusGradleWrapperTestBase.java:140)
	at app//io.quarkus.gradle.QuarkusGradleWrapperTestBase.runGradleWrapper(QuarkusGradleWrapperTestBase.java:57)
	at app//io.quarkus.gradle.QuarkusGradleWrapperTestBase.runGradleWrapper(QuarkusGradleWrapperTestBase.java:52)
	at app//io.quarkus.gradle.nativeimage.QuarkusNativeGradleITBase.runGradleWrapper(QuarkusNativeGradleITBase.java:36)
	at app//io.quarkus.gradle.nativeimage.CustomNativeTestSourceSetIT.runNativeTests(CustomNativeTestSourceSetIT.java:17)
	at [email protected]/java.lang.reflect.Method.invoke(Method.java:569)
	at [email protected]/java.util.ArrayList.forEach(ArrayList.java:1511)

[michalvavrik]

Failures unrelated, fails also here #44642 (comment).

[sberyozkin]

Thanks @michalvavrik