jakartaee / jakartaee/security

@OpenIdAuthenticationMechanismDefinition annotation is not repeatable in 4.0

Open
#342 5 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
66
Forks
43
PR merge metrics
No merged PRs in 30d

Description

I am trying to use two different OIDC authentication provider clients within the same Wildfly 34 Preview JakartaEE 11 web application. As far as I understand, in Jakarta EE 3.0 this is not possible but has been made possible in 4.0 by using Qualifiers.

I have created two servlets, each with the @OpenIdAuthenticationMechanismDefinitionannotation and each with their own Qualifier annotation. However on deployment I still get the error: "Ambiguous dependencies for type OpenIdAuthenticationMechanismDefinition with qualifiers @Default"

My code is as follows:

`
@Qualifier
@Retention(RetentionPolicy.RUNTIME)
@Target({ElementType.TYPE, ElementType.METHOD, ElementType.FIELD, ElementType.PARAMETER})
public @interface QualifierA {
}
`

`
@Qualifier
@Retention(RetentionPolicy.RUNTIME)
@Target({ElementType.TYPE, ElementType.METHOD, ElementType.FIELD, ElementType.PARAMETER})
public @interface QualifierB {
}
`

`
@QualifierA
@OpenIdAuthenticationMechanismDefinition(
providerURI = "${oidcConfigA.issuerUri}",
clientId = "${oidcConfigA.clientId}",
clientSecret = "${oidcConfigA.clientSecret}",
redirectURI = "${baseURL}/oidcredirecturi",
jwksReadTimeout = 5000, jwksConnectTimeout = 5000)
@ServletSecurity(@HttpConstraint(rolesAllowed = "Everyone"))
@WebServlet("/alogin")
public class OidcLoginWebServletA extends HttpServlet {
`

`
@QualifierB
@OpenIdAuthenticationMechanismDefinition(
providerURI = "${oidcConfigB.issuerUri}",
clientId = "${oidcConfigB.clientId}",
clientSecret = "${oidcConfigB.clientSecret}",
redirectURI = "${baseURL}/oidcredirecturi",
jwksReadTimeout = 5000, jwksConnectTimeout = 5000)
@ServletSecurity(@HttpConstraint(rolesAllowed = "Everyone"))
@WebServlet("/blogin")
public class OidcLoginWebServletB extends HttpServlet {
`

I do not know if I am using the feature wrong or if this is an issue? I cannot see an example of this in the tck tests.

Contributor guide

Open the contributing guide

Research direction

Start with the two servlet declarations in the issue and the Jakarta Security TCK tests for OpenIdAuthenticationMechanismDefinition; reproduce the deployment error in WildFly 34 Preview. Trace how the qualifiers are resolved and determine whether both definitions should be supported, then add or update a TCK case that confirms the intended behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.