Allow to do a blocking smallrye-jwt authentication

[sberyozkin]

It is related to smallrye/smallrye-jwt#511.

smallrye-jwt uses an internal blocking Jose4j HTTP client and if the keys have to be fetched from a remote endpoint then it is done at the 1st request time and if the remote keys endpoint is slow or unavailable then the problems like #511 will happen.

As far as smallrye-jwt is concerned, the best effort can be made there to read the keys early. However even in that case, when dealing with the JWK keys, they will have to be refreshed now and then remotely, so a risk of blocking will remain.

So, at the quarkus level it makes sense IMHO to let users control that a blocking authentication has to be performed in case of the slow/unstable remote key endpoints.

This is not a problem at the quarkus-oidc level but since we do not control the client at the smallrye-jwt level, we have to find a workaround. Longer term, 1) making smallrye-jwt reactive - the issue exists 2) making Jose4J HTTPS handler accept a client interface as opposed to its Simple HTTP client for Quarkus to register Vertx client will make it work as well but it may take awhile.

If would be good if it could make it to 2.4.0.CR1, CC @aloubyansky

thanks

[sberyozkin]

Let me make it a draft for now

[sberyozkin]

@stuartwdouglas Hi Stuart - do you think calling IdentityProviderManager.authenticateBlocking can actually work ? I wonder if HttpAuthenticationMechanism can be passed a blocking request context as a RoutingContext attribute ?

[sberyozkin]

Silly me, it can be handled at the identity provider level, one would need to have a class specific blocking request context to call IdentityProviderManager.authenticateBlocking but since smallrye-jwt inlines its own IdentityProvider it can be handled there

[sberyozkin]

Converting to draft again, Roberto, @radcortez, quarkus.smallrye-jwt.blocking-authentication=true has no effect, SmallRyeJwtConfig is injected, but its blockingAuthentication is always false. Can you spot what I'm missing ? Pretty sure it is something silly on my part. You can add quarkus.smallrye-jwt.blocking-authentication=true to one of application.properties in smallrye-jwt/deployment to check, thanks

[sberyozkin]

@radcortez thanks, I've also added a test, I spent nearly an hour last Friday staring at the test file checking for a property typo but could not find a problem and now it just works, sorry for the noise