quarkus: Quarkus Oauth2 quarkus.oauth2.enabled doesn't seem to work

Of course! 😃

I’d say so, I believe we’ve had a good number of similar queries, not sure where, may be at https://quarkus.io/guides/security to start with, have a section How to Disable Authorization. I think it should show the injection of the custom property like authorization-enabled to highlight the point Stuart made, @ejba Hi, are you Ok with doing another PR 😃 ?

So you can do it at runtime as well, but it requires some custom code:

@Alternative
@Priority(Interceptor.Priority.LIBRARY_AFTER)
@ApplicationScoped
public class DisabledAuthController extends AuthorizationController {

    @Override
    public boolean isAuthorizationEnabled() {
        return false;
    }
}

Including this bean in your application will disable security. If you want to make it configurable just make it inject a configuration property using MP config.

I am a bit hesitant about including this as a general config option, it just feels a bit dangerous.

@ejba

However, it’s confusing at first sight to learn what’s the expected behavior when disabling the oauth2 extension and have multiple methods as role protected.

Right this or any other extension dealing with the authentication is only populating a Securityidentity. RBAC level is in the next phase. If one disables oauth2/etc then all what is being achieved is that no auth mechanism is available which can do something meaningful with Bearer sometoken.

I wonder though if the time has come to introduce a property like a default role (someone has suggested it already). Or have a property like disable-role-based-access-control… Or how about proactive-authorization=false which will be disable RBAC if SecurityIdentity is not available…
CC @stuartwdouglas Hi Stuart, what do you think ?

Hi, can I try to fix this?

Le’s see first if this is just a misuse issue