Moving from Wildfly / JEE ContainerRequestFilter for custom security handling isn't working

[stdunbar]

I'm attempting to move from a Wildfly / standard JEE environment that has a ContainerRequestFilter to a non-blocking Quarkus REST implementation. It doesn't seem that Quarkus is doing what I expect but I may be thinking of it wrong.

At a high level, my architecture is that once a JWT has been validated, I want to create users in my DB if they don't exist. My challenge is that I'm not seeing logged in users in a SecurityIdentityAugmentor - everybody is anonymous. If I implement a ContainerRequestFilter, the ContainerRequestContext security context doesn't contain a Principal either. The ContainerRequestFilter implementation is impossible to use with anything that hits the DB - even if my ApplicationScoped bean is marked with Blocking I still get the "Attempting a blocking read on io thread" exception - which honestly sounds like a bug.

Do I give up on the async model of everything on the planet is asynchronous and move back to the non-reactive world? Is there something I'm missing? The docs at https://quarkus.io/guides/security-customization do not reflect what I'm seeing and that's why I'm here.

For reference, this is Quarkus 3.22.3 on Java 21.0.7, LinuxMint 22.1

[quarkus-bot[bot]]

/cc @sberyozkin (security)

[sberyozkin]

@stdunbar
SecurityIdentityAugmentor is useful in a typical Quarkus Security flow, where one of the built-in or custom HttpAuthenticationMechanisms creates an identity and then it must be augmented somehow.

Do you mean that you'd like to use a pre-match JAX-RS ContainerRequestFilter to customize JAX-RS SecurityContext as explained in the security customization doc, and do some DB work along the way as well ? For it to work with Quarkus REST, I guess this filter must return Uni<Void>. See also https://quarkus.io/guides/rest#request-or-response-filters.

Moving this custom logic out of the JAX-RS filter to your own HttpAuthenticationMechanism and IdentityProvider should always be a viable option too.

If you can provide some basic reproducer to show what you are trying to do then it may help us give more specific suggestions.