Adjust 'challenge' selection so that custom auth mechanism is called

[michalvavrik]

fixes: #27180

This PR makes sure io.quarkus.vertx.http.runtime.security.HttpAuthenticationMechanism#send/getChallenge of a custom auth mechanism get called. There is an example of HttpAuthenticationMechanism Customization that don't work for me as built-in auth mechanisms put into routing context themselves and this information is used when selecting an auth mechanism for challenge, I've explained actual behavior in depth in linked issue. This solution needs check from an expert (@sberyozkin ) as I only inferred "expected behavior" from PRs submitted in this area.

[sberyozkin]

I'm not sure it will work - for example, we have both Basic and OIDC mechanisms enabled at the same time, with this PR the challenge caused by a failing basic auth can be picked by OIDC or the other way around, depending on the sorting order.
Perhaps the condition should be: if (mechanisms.size() > 1) ?

[sberyozkin]

And also say in the docs - that your custom authentication mechanism has to add itself to RoutingContext (routingContext.put(HttpAuthenticationMechanism.class.getName(), this);) if more than one authentication mechanism is available to ensure a correct challenge is returned - something along these lines

[michalvavrik]

if (mechanisms.size() > 1) fixes the reproducer only in combination with @Priority(1) @Alternative, that is not a problem in regards of #27180, but I wonder if the auth mechanism selection don't work differently to your expecatation:

Please consider CustomFormAuthenticator without @Priority(1) @Alternative and with routingContext.put(HttpAuthenticationMechanism.class.getName(), this);, if you run such a test, the result depends on the order of mechanisms -> it's random. Sometimes I get 8 times green and then red, sometimes I get couple of failures etc. I think that's because both mechanisms are getting called in io.quarkus.vertx.http.runtime.security.HttpAuthenticator#createSecurityIdentity and who is in the routing context depends on the order.

For that reason, I left out setting the context and adjusted docs so that examples will work. I also fixed some invalid method signatures.

[sberyozkin]

Please consider CustomFormAuthenticator without @priority(1) @Alternative and with routingContext.put(HttpAuthenticationMechanism.class.getName(), this);, if you run such a test, the result depends on the order of mechanisms -> it's random

Sure, I think we have 2 variations here
1: a mechanism such as CustomFormAuthenticator needs to replace the default built in form one. - this is the reproducer case.
(there is also HttpAuthenticationMechanism.getPriority which I guess can be used instead)
2. a totally new custom mechanism one, not conflicting with any of the existing ones, is used alongside for ex OIDC - in this case I think this new mechanism needs to set this attribute.

[michalvavrik]

FYI Now just fixed indentation for docs as originally I had it wrong.

[michalvavrik]

I see, it makes sense.

[quarkus-bot]

Failing Jobs - Building 48d0c87

Status	Name	Step	Failures	Logs	Raw logs
✖	JVM Tests - JDK 11	Build	Failures	Logs	Raw logs
✔️	JVM Tests - JDK 17
✖	JVM Tests - JDK 18	Build	Failures	Logs	Raw logs

Full information is available in the Build summary check run.

Failures

⚙️ JVM Tests - JDK 11 #

- Failing: extensions/smallrye-reactive-messaging-amqp/deployment 
! Skipped: integration-tests/reactive-messaging-amqp 

📦 extensions/smallrye-reactive-messaging-amqp/deployment

✖ io.quarkus.smallrye.reactivemessaging.amqp.AnonymousAmqpTest.test line 30 - More details - Source on GitHub

org.awaitility.core.ConditionTimeoutException: Condition with io.quarkus.smallrye.reactivemessaging.amqp.AnonymousAmqpTest was not fulfilled within 1 minutes.
	at org.awaitility.core.ConditionAwaiter.await(ConditionAwaiter.java:167)
	at org.awaitility.core.CallableCondition.await(CallableCondition.java:78)

---

⚙️ JVM Tests - JDK 18 #

- Failing: integration-tests/oidc-code-flow 

📦 integration-tests/oidc-code-flow

✖ io.quarkus.it.keycloak.CodeFlowTest.testTokenAutoRefresh line 519 - More details - Source on GitHub

com.gargoylesoftware.htmlunit.FailingHttpStatusCodeException: 401 Unauthorized for http://localhost:8081/tenant-autorefresh
	at com.gargoylesoftware.htmlunit.WebClient.throwFailingHttpStatusCodeExceptionIfNecessary(WebClient.java:701)
	at com.gargoylesoftware.htmlunit.WebClient.getPage(WebClient.java:461)

[michalvavrik]

io.quarkus.smallrye.reactivemessaging.amqp.AnonymousAmqpTest clearly not related (vertx disconnected stuff), io.quarkus.it.keycloak.CodeFlowTest.testTokenAutoRefresh I think goes down to missing PublicKey, but I'll run tests locally.

[michalvavrik]

Ah, I can see that's a known issue #27900