How can the Authorization header be propagated in Quarkus Apps with the MicroProfile Rest Client?

Question

I have two microservices implemented with Quarkus 1.5.2.Final with endpoints that are protected with @RolesAllowed("user"). The endpoints work when I call them directly with a valid token.

When I use the MicroProfile Rest Client (synchronous mode) to invoke the second microservice, the Authorization header is missing.

According to the MicroProfile spec (https://download.eclipse.org/microprofile/microprofile-rest-client-1.3/microprofile-rest-client-1.3.html) the following setting should do the trick: org.eclipse.microprofile.rest.client.propagateHeaders=Authorization

However it doesn't work. I also tried these without success. "mp.rest.client.propagateHeaders=Authorization", "resteasy.role.based.security=true" and "quarkus.smallrye-jwt.enabled=true".

When I add the header manually to the Rest Client it works, but my understanding was this should be done automatically.

Do I do anything wrong or could this be an issue with the MicroProfile version embedded in Quarkus 1.5.2.Final?

Thanks!

user_1167759 · Answer

Phillip Krüger answered the question. All that needed to be added was this setting in the service which is invoked by another service.

resteasy.role.based.security=true

Code is here: https://github.com/IBM/cloud-native-starter/blob/d30b084eeddcebf793037bea07244fe20917caa3/security/articles-secure/src/main/resources/application.properties#L9

user_1892568 · Answer

As per the spec, for the mp.rest.client.propagateHeaders property to work you need to have @RegisterClientHeaders specified on the interface that defines the external service.

How can the Authorization header be propagated in Quarkus Apps with the MicroProfile Rest Client?

2 Answers