quarkus: AuthorizationController is not working after 2.2.0.Final

Describe the bug

AuthorizationController is not working any more after 2.2.0.Final.

@Alternative
@Priority(Interceptor.Priority.LIBRARY_AFTER)
@ApplicationScoped
public class DisabledAuthController extends AuthorizationController {

    ....

    @Override
    public boolean isAuthorizationEnabled() {
        return !disableAuthorization;
    }
}

Expected behavior

Authorization is skipped.

Actual behavior

401Unauthorized returned if token not provided or invalid.

How to Reproduce?

No response

Output of `uname -a` or `ver`

Microsoft Windows [Version 10.0.18363.1734]

Output of `java -version`

java version “11.0.10” 2021-01-19 LTS

GraalVM version (if different from Java)

No response

Quarkus version or git rev

2.2.2.Final

Build tool (ie. output of `mvnw --version` or `gradlew --version`)

Apache Maven 3.6.3

Additional information

This commit could probably cause the issue

About this issue

Original URL
State: closed
Created 3 years ago
Comments: 26 (21 by maintainers)

Commits related to this issue

Make sure disabling security works with RR Fixes #20144 — committed to stuartwdouglas/quarkus by stuartwdouglas 3 years ago
Make sure disabling security works with RR Fixes #20144 (cherry picked from commit 3e7bf2e0ca6d12ce96ea587cf10f90a1b980834c) — committed to geoand/quarkus by stuartwdouglas 3 years ago

Most upvoted comments

I’d be surprised if it’s not fixed with 2.3.0.CR1. Can it be checked and also compared with the quarkus-resteasy behavior? If it doesn’t work, then I totally agree it needs to be fixed

geoand on Sep 27, 2021

@cemnura Sorry, seeing it only now - I don’t know why but I’m not always seeing the pings, strangely enough, I see it every time quarkus-bot is pinging me 😃

Thanks for spending your time on this issue,

Can you please check if it works with quarkus-resteasy ?

@geoand - do you agree it would make sense for resteasy-reactive to have AuthorizationController checked as well ?

sberyozkin on Sep 27, 2021

Not at the moment. I’ll let you know 😃

geoand on Sep 29, 2021

I quickly updated the quarkus version to 2.3.0.CR1 and tried to disable the authentication via DisabledAuthController with quarkus-resteasy-reactive yet I am still receiving 401 Unauthorized error.

quarkus-resteasy works the same as 2.2.3.Final. I can turn authentication via DisabledAuthController depending on my configuration.

Confirm - 2.3.0.CR1 is not working for me as well.

andrewlunin on Sep 28, 2021

@sberyozkin Hi Sergey, I still have the branch #16852. Let me update it to the latest Quarkus V2 and see what I can do for this.

cemnura on Sep 14, 2021