Allow quarkus-oidc to customize response body of 403

user_17043317 0
Viewed 306

I want to customize the response body of 403/401 in quarkus oidc application. I have tried many things to implement that but not able to do so. Same can be achieved in Spring boot easily.

quarkus-oidc quarkus keycloak openid-connect java
1 Answers

With declarative security(@RolesAllowed, @Authenticated...) the auth violation errors are handled as exceptions thrown by the security extension, These exceptions are then mapped using standard JAXRS exception mapping mechanism.

That means, the only thing you need to modify the responses for these errrors, is to create an exception mapper for the specific exception you want. In Quarkus security the relevant exceptions are: io.quarkus.security.ForbiddenException and io.quarkus.security.UnauthorizedException for the 403 and 401 errors respectively.

An example mapper for the 403/Forbidden error:

import io.quarkus.security.ForbiddenException;

import javax.annotation.Priority;
import javax.ws.rs.core.Response;
import javax.ws.rs.ext.ExceptionMapper;
import javax.ws.rs.ext.Provider;

@Provider//register as JAXRS provider
@Priority(1)//override the build-int mapper(which has 5001 prio)
public class ForbiddenExceptionMapper implements ExceptionMapper<ForbiddenException> {
  @Override
  public Response toResponse(ForbiddenException exception) {
    return Response.status(Response.Status.FORBIDDEN)
      .entity(new MyErrorObject("ERR_NO_ACCESS","Sorry access forbidden"))
      .build();
  }
}

Do note, that your exception mappers need to have correct @Priority value(the lower the value, the higher the prio) because Quarkus already bundles mappers for these exceptions(inside quarkus-resteasy extension), so you need to provide a mapper with higher prio to override them. Those build-in mappers are actually responsible for the 401/403 responses you see.

user_22209970
Related