Use SecurityIdentityAugmentor to investigate blocking code to query user permissions. Inconsistency in user information in SecurityIdentity may occur during concurrency.

[LiuBo-keep]

The code sample is as follows：

@Priority(Priorities.AUTHENTICATION)
@Slf4j
 @ApplicationScoped
 public class OidcSecurityIdentityFilter implements SecurityIdentityAugmentor {

          @Inject
          OidcSecurityIdentitySupplier supplier;

          @Override
         public int priority() {
           return 0;
         }

        @Override
         public Uni<SecurityIdentity> augment(SecurityIdentity securityIdentity,
                                       AuthenticationRequestContext authenticationRequestContext) {

       if (securityIdentity.isAnonymous()) {
          return Uni.createFrom().item(securityIdentity);
          }

        supplier.setIdentity(securityIdentity);
         return authenticationRequestContext.runBlocking(supplier);
  }
}

       @Slf4j
       @Dependent
       public class OidcSecurityIdentitySupplier implements Supplier<SecurityIdentity> {

       private SecurityIdentity identity;

       @ActivateRequestContext
       @Override
        public SecurityIdentity get() {

      Set<String> roles = identity.getRoles();
      String tenantId = identity.getAttribute("tenant-id");
      String username = identity.getPrincipal().getName();

      System.out.println("username = " + username);

      ConnectionProvider connectionProvider = tenantDataSourceCenter.getConnProviderMap().get(tenantId);

      Set<String> permissionSet = null;

      permissionSet = securityPermissionService.queryPermissionsByUsername(tenantId, username, roles,
            connectionProvider, identity);

      QuarkusSecurityIdentity build = QuarkusSecurityIdentity.builder()
          .setPrincipal(identity.getPrincipal())
          .addAttributes(identity.getAttributes())
          .addCredentials(identity.getCredentials())
          .addRoles(permissionSet)
          .build();

      System.out.println("username = " + build.getPrincipal().getName());    

      return build;
  }

      public void setIdentity(final SecurityIdentity identity) {
         this.identity = identity;
        }
    }

Occasionally, you will find that the user names output twice are different.

[sberyozkin]

@LiuBo-keep You may have to use Instance<OidcSecurityIdentitySupplier>

[LiuBo-keep]

That's right. It's running normally. Thank you very much.