Query REST API throw 401 in Quarkus application with @RolesAllowed #24093

ombinte · 2022-03-04T08:47:06Z

ombinte
Mar 4, 2022

In my Quarkus microservice i use the SamllRye JWT API for validation of JWT and Microprofile @RolesAllowed for securisation of my REST API.

For test it I generated a JWT using the GenerateToken define in security-jwt-quickstart in Quarkus quickstars project : https://github.com/quarkusio/quarkus-quickstarts: I used privateKey.pem and publicKey.pem found in the project

When I try to get use my REST API I always obtain a http code 401

REST Api

package com.omb;

import com.omb.queries.MyQueryService;
import com.omb.queries.MyResource;
import org.eclipse.microprofile.jwt.JsonWebToken;

import javax.annotation.security.PermitAll;
import javax.annotation.security.RolesAllowed;
import javax.inject.Inject;
import javax.ws.rs.GET;
import javax.ws.rs.Path;
import javax.ws.rs.PathParam;
import java.util.List;
import java.util.concurrent.CompletableFuture;


@Path("/queries")
public class MyQueryController {

    @Inject
    JsonWebToken jwt;

    @Inject
    MyQueryService myQueryService;

    @GET
    @RolesAllowed({"User", "Admin"})
    public CompletableFuture<List<MyResource>> getResources() {
        return schedulingQueryService.getResources();
    }
}

application.properties

mp.jwt.verify.publickey.location=publicKey.pem
quarkus.native.resources.includes=publicKey.pem
smallrye.jwt.sign.key.location=privateKey.pem

JWT generate

eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJRdWFya3VzIEdlbmVyYXRlVG9rZW4iLCJzdWIiOiJqZG9lYWRtaW4iLCJ1cG4iOiJqZG9lIiwiYXVkIjoib21iLmNvbSIsImV4cCI6MTk1ODIwMDU3NiwiaWF0IjoxNjQyNjY3Nzc2LCJncm91cHMiOlsiQWRtaW4iXSwiR2l2ZW5OYW1lIjoiamRvZWFkbWluIiwiU3VybmFtZSI6IkRvZSIsIkVtYWlsIjoiamRvZUBlbWFpbC5jb20iLCJSb2xlIjoiQWRtaW4iLCJqdGkiOiIyYTk0MGJiNy1lNTQyLTQzMmQtOTg3MS00ZGE1YWRhNDY3NDUifQ.L4drXUkH_leu4Wb36g_pVdGil0f9hlzQwDzknXq2xTdQdv5TKmnj27mRzVU2oP1ZfbgwYKUhdA8YqXuwfLt5ja8yFB7Lc26a8RBdIAHFcnq4Q37Ged57mbPt35aQ68kWyRP7ouRj-BgUnnOaQaIlMQnkKA5JBP1uzH4A0OBiN2FGvAVgvu0R-2o-JTapwo4OR7BtkC2glDsm2Xgqk8jylxrktWEaxhuliuHG9s2JVJXmRrvc7DuQJICCiQYb8UkzrIgsLtkTV5X32cQmGKBVhvv7GzbZbZC49f2JB56ShfqfKdOo52NJ9YBCCFwaEf1q5I3I9_aItcmVOwNCK56WQA

Error log

2022-03-03 17:32:39,581 DEBUG [io.qua.sma.jwt.run.aut.MpJwtValidator] (vert.x-eventloop-thread-2) Authentication failed: io.smallrye.jwt.auth.principal.ParseException: SRJWT07000: Failed to verify a token
    at io.smallrye.jwt.auth.principal.DefaultJWTTokenParser.parseClaims(DefaultJWTTokenParser.java:164)
    at io.smallrye.jwt.auth.principal.DefaultJWTTokenParser.parse(DefaultJWTTokenParser.java:56)
    at io.smallrye.jwt.auth.principal.DefaultJWTCallerPrincipalFactory.parse(DefaultJWTCallerPrincipalFactory.java:31)
    at io.smallrye.jwt.auth.principal.DefaultJWTParser.parse(DefaultJWTParser.java:64)
    at io.smallrye.jwt.auth.principal.DefaultJWTParser_Subclass.parse$$superforward1(Unknown Source)
    at io.smallrye.jwt.auth.principal.DefaultJWTParser_Subclass$$function$$6.apply(Unknown Source)
    at io.quarkus.arc.impl.AroundInvokeInvocationContext.proceed(AroundInvokeInvocationContext.java:54)
    at io.quarkus.arc.runtime.devconsole.InvocationInterceptor.proceed(InvocationInterceptor.java:62)
    at io.quarkus.arc.runtime.devconsole.InvocationInterceptor.monitor(InvocationInterceptor.java:51)
    at io.quarkus.arc.runtime.devconsole.InvocationInterceptor_Bean.intercept(Unknown Source)
    at io.quarkus.arc.impl.InterceptorInvocation.invoke(InterceptorInvocation.java:41)
    at io.quarkus.arc.impl.AroundInvokeInvocationContext.perform(AroundInvokeInvocationContext.java:41)
    at io.quarkus.arc.impl.InvocationContexts.performAroundInvoke(InvocationContexts.java:32)
    at io.smallrye.jwt.auth.principal.DefaultJWTParser_Subclass.parse(Unknown Source)
    at io.smallrye.jwt.auth.principal.DefaultJWTParser_ClientProxy.parse(Unknown Source)
    at io.quarkus.smallrye.jwt.runtime.auth.MpJwtValidator.createSecurityIdentity(MpJwtValidator.java:71)
    at io.quarkus.smallrye.jwt.runtime.auth.MpJwtValidator$1.accept(MpJwtValidator.java:57)
    at io.quarkus.smallrye.jwt.runtime.auth.MpJwtValidator$1.accept(MpJwtValidator.java:53)
    at io.smallrye.context.impl.wrappers.SlowContextualConsumer.accept(SlowContextualConsumer.java:21)
    at io.smallrye.mutiny.operators.uni.builders.UniCreateWithEmitter.subscribe(UniCreateWithEmitter.java:22)
    at io.smallrye.mutiny.operators.AbstractUni.subscribe(AbstractUni.java:36)
    at io.smallrye.mutiny.operators.uni.UniMemoizeOp.subscribe(UniMemoizeOp.java:84)
    at io.smallrye.mutiny.operators.AbstractUni.subscribe(AbstractUni.java:36)
    at io.smallrye.mutiny.groups.UniSubscribe.withSubscriber(UniSubscribe.java:52)
    at io.quarkus.vertx.http.runtime.security.HttpSecurityRecorder$2.handle(HttpSecurityRecorder.java:113)
    at io.quarkus.vertx.http.runtime.security.HttpSecurityRecorder$2.handle(HttpSecurityRecorder.java:60)
    at io.vertx.ext.web.impl.RouteState.handleContext(RouteState.java:1212)
    at io.vertx.ext.web.impl.RoutingContextImplBase.iterateNext(RoutingContextImplBase.java:163)
    at io.vertx.ext.web.impl.RoutingContextImpl.next(RoutingContextImpl.java:141)
    at io.quarkus.vertx.http.runtime.cors.CORSFilter.handle(CORSFilter.java:178)
    at io.quarkus.vertx.http.runtime.cors.CORSFilter.handle(CORSFilter.java:18)
    at io.vertx.ext.web.impl.RouteState.handleContext(RouteState.java:1212)
    at io.vertx.ext.web.impl.RoutingContextImplBase.iterateNext(RoutingContextImplBase.java:163)
    at io.vertx.ext.web.impl.RoutingContextImpl.next(RoutingContextImpl.java:141)
    at io.quarkus.vertx.http.runtime.devmode.VertxHttpHotReplacementSetup.handleHotReplacementRequest(VertxHttpHotReplacementSetup.java:135)
    at io.quarkus.vertx.http.runtime.VertxHttpRecorder$8.handle(VertxHttpRecorder.java:410)
    at io.quarkus.vertx.http.runtime.VertxHttpRecorder$8.handle(VertxHttpRecorder.java:406)
    at io.vertx.ext.web.impl.RouteState.handleContext(RouteState.java:1212)
    at io.vertx.ext.web.impl.RoutingContextImplBase.iterateNext(RoutingContextImplBase.java:163)
    at io.vertx.ext.web.impl.RoutingContextImpl.next(RoutingContextImpl.java:141)
    at io.vertx.ext.web.impl.RouterImpl.handle(RouterImpl.java:67)
    at io.vertx.ext.web.impl.RouterImpl.handle(RouterImpl.java:37)
    at io.quarkus.vertx.http.runtime.VertxHttpRecorder$12.handle(VertxHttpRecorder.java:488)
    at io.quarkus.vertx.http.runtime.VertxHttpRecorder$12.handle(VertxHttpRecorder.java:485)
    at io.quarkus.vertx.http.runtime.VertxHttpRecorder$1.handle(VertxHttpRecorder.java:154)
    at io.quarkus.vertx.http.runtime.VertxHttpRecorder$1.handle(VertxHttpRecorder.java:136)
    at io.vertx.core.http.impl.Http1xServerRequestHandler.handle(Http1xServerRequestHandler.java:67)
    at io.vertx.core.http.impl.Http1xServerRequestHandler.handle(Http1xServerRequestHandler.java:30)
    at io.vertx.core.impl.EventLoopContext.emit(EventLoopContext.java:50)
    at io.vertx.core.impl.DuplicatedContext.emit(DuplicatedContext.java:168)
    at io.vertx.core.http.impl.Http1xServerConnection.handleMessage(Http1xServerConnection.java:145)
    at io.vertx.core.net.impl.ConnectionBase.read(ConnectionBase.java:156)
    at io.vertx.core.net.impl.VertxHandler.channelRead(VertxHandler.java:153)
    at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)
    at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)
    at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357)
    at io.netty.channel.ChannelInboundHandlerAdapter.channelRead(ChannelInboundHandlerAdapter.java:93)
    at io.netty.handler.codec.http.websocketx.extensions.WebSocketServerExtensionHandler.channelRead(WebSocketServerExtensionHandler.java:99)
    at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)
    at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)
    at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357)
    at io.netty.handler.timeout.IdleStateHandler.channelRead(IdleStateHandler.java:286)
    at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)
    at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)
    at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357)
    at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:327)
    at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:299)
    at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)
    at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)
    at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357)
    at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410)
    at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)
    at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)
    at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919)
    at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166)
    at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:722)
    at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:658)
    at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:584)
    at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:496)
    at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:986)
    at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
    at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
    at java.base/java.lang.Thread.run(Thread.java:833)
Caused by: org.jose4j.jwt.consumer.InvalidJwtException: JWT processing failed. Additional details: [[17] Unable to process JOSE object (cause: org.jose4j.lang.InvalidAlgorithmException: 'HS256' is not a permitted algorithm.): JsonWebSignature{"typ":"JWT","alg":"HS256"}->eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJPbmxpbmUgSldUIEJ1aWxkZXIiLCJpYXQiOjE2NDI2Njc3NzYsImV4cCI6MTk1ODIwMDU3NiwiYXVkIjoiYmF0Y2htYW5hZ2VtZW50LmNyb3NzLXN5c3RlbXMuY29tIiwic3ViIjoiamRvZSIsIkdpdmVuTmFtZSI6IkpvaG4iLCJTdXJuYW1lIjoiRG9lIiwiRW1haWwiOiJqZG9lQGNyb3NzLXN5c3RlbXMuY29tIiwiUm9sZSI6IlVzZXIiLCJzY3AiOiJBY2Nlc3MifQ.ePr-FzO-7w4A1-vKNE5AlIr973ySRbv3PojMR3PNc4k]
    at org.jose4j.jwt.consumer.JwtConsumer.processContext(JwtConsumer.java:264)
    at org.jose4j.jwt.consumer.JwtConsumer.process(JwtConsumer.java:426)
    at io.smallrye.jwt.auth.principal.DefaultJWTTokenParser.parseClaims(DefaultJWTTokenParser.java:143)
    ... 82 more
Caused by: org.jose4j.lang.InvalidAlgorithmException: 'HS256' is not a permitted algorithm.
    at org.jose4j.jwa.AlgorithmConstraints.checkConstraint(AlgorithmConstraints.java:80)
    at org.jose4j.jws.JsonWebSignature.getAlgorithm(JsonWebSignature.java:279)
    at org.jose4j.jws.JsonWebSignature.getAlgorithm(JsonWebSignature.java:260)
    at org.jose4j.jws.JsonWebSignature.verifySignature(JsonWebSignature.java:234)
    at org.jose4j.jwt.consumer.JwtConsumer.processContext(JwtConsumer.java:222)

sberyozkin · 2022-03-04T11:36:15Z

sberyozkin
Mar 4, 2022
Collaborator

@ombinte the token you have pasted above has RS256 algorithm, while the token which is reported in the stack trace has HS256 and it was not produced by smallrye-jwt-build (it can use symmetric keys if needed though).
If you need to support HS256 then set smallrye.jwt.verify.algorithm=HS256 (I'll update the docs - they are outdated - it is only this property's usage for customizing asymmetric algorithms like RS* or ES* which is deprecated since there is a standard property available for that)

2 replies

ombinte Mar 4, 2022
Author

Hi @sberyozkin
I fixed my problem, it's because my Angular application wasent sent the good JWT

Regards

sberyozkin Mar 4, 2022
Collaborator

OK, thanks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Query REST API throw 401 in Quarkus application with @RolesAllowed #24093

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 2 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Query REST API throw 401 in Quarkus application with @RolesAllowed #24093

Uh oh!

ombinte Mar 4, 2022

Replies: 1 comment · 2 replies

Uh oh!

sberyozkin Mar 4, 2022 Collaborator

Uh oh!

ombinte Mar 4, 2022 Author

Uh oh!

sberyozkin Mar 4, 2022 Collaborator

ombinte
Mar 4, 2022

Replies: 1 comment 2 replies

sberyozkin
Mar 4, 2022
Collaborator

ombinte Mar 4, 2022
Author

sberyozkin Mar 4, 2022
Collaborator