Skip to content

Support for OIDC SPIFFE Client Authentication#53773

Merged
sberyozkin merged 1 commit intoquarkusio:mainfrom
sberyozkin:spiffe_client_authentication
Apr 27, 2026
Merged

Support for OIDC SPIFFE Client Authentication#53773
sberyozkin merged 1 commit intoquarkusio:mainfrom
sberyozkin:spiffe_client_authentication

Conversation

@sberyozkin
Copy link
Copy Markdown
Member

@sberyozkin sberyozkin commented Apr 23, 2026

Fixes #52232

This PR adds support for using SPIFFE JWT tokens for the client authentication between Quarkus OIDC and providers such as Keycloak.

It builds upon the work done by @michalvavrik, with the demo work from @sabre1041 and @maia-iyer at https://github.com/sabre1041/keycloakcon-spiffe/ clarifying a typical pattern for using such tokens for the client authentication.

This PR will fix the linked issue.

As far as X509 client authentication is concerned, it is expected to work out of the box where the OIDC client certificate is located in the file, though I think we'll need to figure out how to handle the dynamism associated with such certificates being regularly refreshed. It will be another enhancement request

@sberyozkin sberyozkin requested a review from michalvavrik April 23, 2026 13:04
@quarkus-bot quarkus-bot Bot added area/docstyle issues related for manual docstyle review area/documentation area/oidc labels Apr 23, 2026
@quarkus-bot

This comment has been minimized.

Sign in to view
@quarkus-bot

This comment has been minimized.

Sign in to view
github-advanced-security[bot]
github-advanced-security AI found potential problems Apr 23, 2026
View reviewed changes
Comment thread ...e/src/main/java/io/quarkus/oidc/common/runtime/KubernetesServiceClientAssertionProvider.java Fixed
Comment thread ...e/src/main/java/io/quarkus/oidc/common/runtime/KubernetesServiceClientAssertionProvider.java Fixed
Comment thread ...e/src/main/java/io/quarkus/oidc/common/runtime/KubernetesServiceClientAssertionProvider.java Dismissed
Comment thread ...e/src/main/java/io/quarkus/oidc/common/runtime/KubernetesServiceClientAssertionProvider.java Fixed
Comment thread ...e/src/main/java/io/quarkus/oidc/common/runtime/KubernetesServiceClientAssertionProvider.java Fixed
Comment thread ...e/src/main/java/io/quarkus/oidc/common/runtime/KubernetesServiceClientAssertionProvider.java Fixed
Comment thread ...e/src/main/java/io/quarkus/oidc/common/runtime/KubernetesServiceClientAssertionProvider.java Fixed
Comment thread ...e/src/main/java/io/quarkus/oidc/common/runtime/KubernetesServiceClientAssertionProvider.java Dismissed
@sberyozkin sberyozkin force-pushed the spiffe_client_authentication branch from 8998167 to 1e43f3b Compare April 23, 2026 14:15
@sberyozkin
Copy link
Copy Markdown
Member Author

sberyozkin commented Apr 23, 2026

I forgot to add a test resource, it caused the compilation failure.
Also, dismissed alerts as false postives, no actual token is logged, only its type

@quarkus-bot

This comment has been minimized.

Sign in to view
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 23, 2026 •
edited
Loading

🙈 The PR is closed and the preview is expired.

@quarkus-bot

This comment has been minimized.

Sign in to view
@michalvavrik
Copy link
Copy Markdown
Member

michalvavrik commented Apr 23, 2026

I'll review sometimes tomorrow.

michalvavrik
michalvavrik reviewed Apr 24, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@michalvavrik michalvavrik left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I only run quickly through it + asked Claude to check it. I'll read it properly again when you address my comments. I already did a lot of unrelated reading today, so I need to check tonight. But I presume it will be fine. Thanks

@sberyozkin
Copy link
Copy Markdown
Member Author

sberyozkin commented Apr 24, 2026

Thanks @michalvavrik , I'll have a look

michalvavrik
michalvavrik reviewed Apr 24, 2026
View reviewed changes
Comment thread docs/src/main/asciidoc/security-openid-connect-client-reference.adoc Outdated
michalvavrik
michalvavrik reviewed Apr 24, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@michalvavrik michalvavrik left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I checked again, looks fine. Let's address at least some of my comments and then we can ask George to review.

@sberyozkin sberyozkin force-pushed the spiffe_client_authentication branch from 1e43f3b to dca417c Compare April 27, 2026 12:00
@sberyozkin
Copy link
Copy Markdown
Member Author

sberyozkin commented Apr 27, 2026

@michalvavrik Please have another quick check when you get a chance, I updated the code to log and return null, no actual log statements are checks but null is checked. Did a few field name updates, for ex, jwtAssertionProvided is a flag that indicates that it is not generated but provided...

@quarkus-bot
Copy link
Copy Markdown

quarkus-bot Bot commented Apr 27, 2026

Status for workflow Quarkus Documentation CI

This is the status report for running Quarkus Documentation CI on commit dca417c.

✅ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

Warning

There are other workflow runs running, you probably need to wait for their status before merging.

@quarkus-bot
Copy link
Copy Markdown

quarkus-bot Bot commented Apr 27, 2026 •
edited by github-actions Bot
Loading

Status for workflow Quarkus CI

This is the status report for running Quarkus CI on commit dca417c.

✅ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

You can consult the Develocity build scans.

michalvavrik
michalvavrik approved these changes Apr 27, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@michalvavrik michalvavrik left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks

github-advanced-security[bot]
github-advanced-security AI found potential problems Apr 27, 2026
View reviewed changes
Comment thread ...e/src/main/java/io/quarkus/oidc/common/runtime/KubernetesServiceClientAssertionProvider.java Dismissed
Comment thread ...e/src/main/java/io/quarkus/oidc/common/runtime/KubernetesServiceClientAssertionProvider.java Dismissed
Comment thread ...e/src/main/java/io/quarkus/oidc/common/runtime/KubernetesServiceClientAssertionProvider.java Dismissed
Comment thread ...e/src/main/java/io/quarkus/oidc/common/runtime/KubernetesServiceClientAssertionProvider.java Dismissed
Comment thread ...e/src/main/java/io/quarkus/oidc/common/runtime/KubernetesServiceClientAssertionProvider.java Dismissed
Comment thread ...e/src/main/java/io/quarkus/oidc/common/runtime/KubernetesServiceClientAssertionProvider.java Dismissed
@michalvavrik michalvavrik requested a review from gastaldi April 27, 2026 13:06
@sberyozkin
Copy link
Copy Markdown
Member Author

sberyozkin commented Apr 27, 2026

Thanks @michalvavrik @gastaldi, I had to dismiss a few more false positive alerts related to a possible logging of the token, as no actual token is logged

@sberyozkin sberyozkin merged commit d924b6d into quarkusio:main Apr 27, 2026
38 checks passed
@quarkus-bot quarkus-bot Bot added this to the 3.36 - main milestone Apr 27, 2026
@sberyozkin sberyozkin deleted the spiffe_client_authentication branch April 27, 2026 13:40
@quarkus-bot quarkus-bot Bot added the kind/enhancement New feature or request label Apr 27, 2026
@rsvoboda rsvoboda mentioned this pull request Apr 28, 2026
Merged
10 tasks
@michalvavrik michalvavrik mentioned this pull request May 3, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gastaldi gastaldi gastaldi approved these changes

+2 more reviewers

@github-advanced-security github-advanced-security[bot] github-advanced-security[bot] left review comments

@michalvavrik michalvavrik michalvavrik approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

area/docstyle issues related for manual docstyle review area/documentation area/oidc kind/enhancement New feature or request release/noteworthy-feature

Projects

None yet

Milestone

3.36 - main

Development

Successfully merging this pull request may close these issues.

Support for SPIFFE JWT-SVID OIDC client authentication

4 participants

@sberyozkin @michalvavrik @gastaldi @github-advanced-security