Adding Authorization token in request while calling external service using RegisterRestClient

[nitinty]

Hello Everyone,

I’m trying to add a token to the request header when calling an external service. I found the ReactiveClientHeadersFactory class in the Quarkus framework to achieve this. However, it requires my client to be annotated with @RegisterClientHeaders(ReactiveClientHeadersFactoryImpl.class), which means I would need to add this annotation to every client individually.

Is there a way to define this globally so that it can be invoked before all requests to the external system without having to use @RegisterClientHeaders on each client? (Other than filter approach)

package org.quarkus.start.web.out;

import io.quarkus.rest.client.reactive.ReactiveClientHeadersFactory;
import io.smallrye.mutiny.Uni;
import io.vertx.core.Vertx;
import jakarta.inject.Inject;
import jakarta.ws.rs.core.MultivaluedHashMap;
import jakarta.ws.rs.core.MultivaluedMap;


public class ReactiveClientHeadersFactoryImpl extends ReactiveClientHeadersFactory {
    @Inject
    Vertx vertx;

    @Override
    public Uni<MultivaluedMap<String, String>> getHeaders(MultivaluedMap<String, String> incomingHeaders,
                                                          MultivaluedMap<String, String> clientOutgoingHeaders) {
        return Uni.createFrom().emitter(e -> {
            MultivaluedHashMap<String, String> tokenHeaders = new MultivaluedHashMap<>();
            // tokenHeaders.add("Authorization", tokenService.getToken());
            tokenHeaders.add("Authorization", "Bearer token_value");
            vertx.setTimer(100L, id -> e.complete(tokenHeaders));
        });
    }
}


@Path("/api/numbers")
@RegisterRestClient(configKey = "numberResource")
@RegisterClientHeaders(ReactiveClientHeadersFactoryImpl.class)
public interface INumberResource {

    @GET
    @Path("/reactive")
    @Produces(MediaType.APPLICATION_JSON)
    @Consumes(MediaType.APPLICATION_JSON)
    public Uni<IsbnThirteen> getIsbnNumberReactive();

}

[nitinty]

@geoand @cescoffier
Can you please assist on this ?

[sberyozkin]

@nitinty I recommend using OIDC token propagation, https://quarkus.io/guides/security-openid-connect-client-reference#token-propagation-rest

Note in this case the incoming bearer token must be verified first before being propagated, you can use quarkus-oidc or quarkus-smallrye-jwt for that...

Propagating unverified tokens risks turning the endpoint into a proxy which will send even invalid tokens to the downstream internal services. If the token is invalid, even if the downstream service is capable of rejecting it, the pressure on the whole system grows with posisbly foreign tokens flowing through it

[geoand]

What @sberyozkin proposes is the proper way to go if you are looking for OIDC token propagation.

If your use case is little different and the OOTB functionality does not cover your needs, there are a few way to achieve the end result you are after. Here is one:

Create an implementation of RestClientBuilderListener and make sure it is registered with the Java Service Loader mechanism by adding META-INF/services/org.eclipse.microprofile.rest.client.spi.RestClientBuilderListener file containing:

my.package.MyRestClientBuilderListener

Then your MyRestClientBuilderListener will look something like this

public static class CustomRestClientBuilderListener implements RestClientBuilderListener {

   @Override
   public void onNewBuilder(RestClientBuilder builder) {
       builder.register(new ClientHeadersFactoryContextResolver(
              Arc.container().instance(MyReactiveClientHeadersFactory.class).get()));
   }

   @Unremovable
   @ApplicationScoped
   public static class MyReactiveClientHeadersFactory extends ReactiveClientHeadersFactory {

        @Override
        public Uni<MultivaluedMap<String, String>> getHeaders(MultivaluedMap<String, String> incomingHeaders,
                MultivaluedMap<String, String> clientOutgoingHeaders) {
            // TODO: implement in whatever way makes sense, including calling other CDI beans
        }
    }

}

This way you ensure that every REST client will use MyReactiveClientHeadersFactory

[sberyozkin]

Hi @geoand Thanks for showing the REST way of dealing with it, just a minor clarification,

What @sberyozkin proposes is the proper way to go if you are looking for OIDC token propagation.

It was more about suggesting the tokens should be verified, before being forwarded downstream. I know, OIDC token propagation sounds like it can only work for OIDC tokens issued by Keycloak/Auth0/etc, but it can also work with quarkus-smallrye-jwt - if, for example, one has an access to a public token verification key, then quarkus-smallrye-jwt is added, public key is referenced, and it will verify tokens which were self-issued, generated with some tools.

I can definitely imagine though there could be API keys flowing as tokens, etc, where OIDC token propagation won't work, thanks for clarifying that

[nitinty]

Thank you @sberyozkin @geoand for your reply.

Our use case is slightly different, as we use different token strategies based on the external service being called.
I believe the RestClientBuilderListener approach (similar to feign.RequestInterceptor) will work for our scenario.

I’ll provide an update here once the migration is complete.

[nitinty]

Then your MyRestClientBuilderListener will look something like this

public static class CustomRestClientBuilderListener implements RestClientBuilderListener {

   @Override
   public void onNewBuilder(RestClientBuilder builder) {
       builder.register(new ClientHeadersFactoryContextResolver(
              Arc.container().instance(MyReactiveClientHeadersFactory.class).get()));
   }

   @Unremovable
   @ApplicationScoped
   public static class MyReactiveClientHeadersFactory extends ReactiveClientHeadersFactory {

        @Override
        public Uni<MultivaluedMap<String, String>> getHeaders(MultivaluedMap<String, String> incomingHeaders,
                MultivaluedMap<String, String> clientOutgoingHeaders) {
            // TODO: implement in whatever way makes sense, including calling other CDI beans
        }
    }

}

This way you ensure that every REST client will use MyReactiveClientHeadersFactory

@geoand

I tried this approach, and the Factory is being invoked for all REST client calls. However, the challenge I'm facing is that we're not receiving the configKey (from @RegisterRestClient(configKey = "test-key")) or client-specific configuration on this factory class to determine which token strategy to apply in the headers.

Do you have any suggestions to address this?

[geoand]

You can probably combine with org.eclipse.microprofile.rest.client.spi.RestClientListener to do what you want