jakartaee / jakartaee/security
@OpenIdAuthenticationMechanismDefinition annotation is not repeatable in 4.0
- Dominant language
- Java
- Stars
- 66
- Forks
- 43
- PR merge metrics
- No merged PRs in 30d
Description
I am trying to use two different OIDC authentication provider clients within the same Wildfly 34 Preview JakartaEE 11 web application. As far as I understand, in Jakarta EE 3.0 this is not possible but has been made possible in 4.0 by using Qualifiers.
I have created two servlets, each with the @OpenIdAuthenticationMechanismDefinitionannotation and each with their own Qualifier annotation. However on deployment I still get the error: "Ambiguous dependencies for type OpenIdAuthenticationMechanismDefinition with qualifiers @Default"
My code is as follows:
`
@Qualifier
@Retention(RetentionPolicy.RUNTIME)
@Target({ElementType.TYPE, ElementType.METHOD, ElementType.FIELD, ElementType.PARAMETER})
public @interface QualifierA {
}
`
`
@Qualifier
@Retention(RetentionPolicy.RUNTIME)
@Target({ElementType.TYPE, ElementType.METHOD, ElementType.FIELD, ElementType.PARAMETER})
public @interface QualifierB {
}
`
`
@QualifierA
@OpenIdAuthenticationMechanismDefinition(
providerURI = "${oidcConfigA.issuerUri}",
clientId = "${oidcConfigA.clientId}",
clientSecret = "${oidcConfigA.clientSecret}",
redirectURI = "${baseURL}/oidcredirecturi",
jwksReadTimeout = 5000, jwksConnectTimeout = 5000)
@ServletSecurity(@HttpConstraint(rolesAllowed = "Everyone"))
@WebServlet("/alogin")
public class OidcLoginWebServletA extends HttpServlet {
`
`
@QualifierB
@OpenIdAuthenticationMechanismDefinition(
providerURI = "${oidcConfigB.issuerUri}",
clientId = "${oidcConfigB.clientId}",
clientSecret = "${oidcConfigB.clientSecret}",
redirectURI = "${baseURL}/oidcredirecturi",
jwksReadTimeout = 5000, jwksConnectTimeout = 5000)
@ServletSecurity(@HttpConstraint(rolesAllowed = "Everyone"))
@WebServlet("/blogin")
public class OidcLoginWebServletB extends HttpServlet {
`
I do not know if I am using the feature wrong or if this is an issue? I cannot see an example of this in the tck tests.
Contributor guide
Research direction
Start with the two servlet declarations in the issue and the Jakarta Security TCK tests for OpenIdAuthenticationMechanismDefinition; reproduce the deployment error in WildFly 34 Preview. Trace how the qualifiers are resolved and determine whether both definitions should be supported, then add or update a TCK case that confirms the intended behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100