1

I am having an issue with Quarkus and Smallrye-JWT. I have a scheme for dynamically looking up the (private) key for the consuming service to decrypt the token and the (public) key from the issuing service to verify the token.

However, no matter what I try, I cannot get it to execute within a context that can make database calls. It throws a javax.enterprise.context.ContextNotActiveException which I understand what it means but I cannot get it to go away. It seems like the JWT parsing factory may not be executing in a worker thread/active context.

The documentation suggests creating a custom factory but that doesn't really help. The JWT factory's parse method is run within an I/O thread and is not reactive so it can't block anyway.

I tried extending io.quarkus.smallrye.jwt.runtime.auth.JWTAuthMechanism and overwriting the authenticate method with my @Alternate annotated implementation. This returns a Uni<> but no matter what I do I can't get the key resolution methods to run within an active context from there.

Here is the source repository. The JWT authentication mechanism is here. The KeyResolver (that actually uses the active record pattern to look up the keys) is here.

The question is: how do I run something in an active context on a worker thread when it is being invoked inside of the security resolution?

Chris Ruffalo
  • 1,903
  • 12
  • 17

1 Answers1

0

There are several layers to fixing this problem. The first is to make JWT parsing blocking with quarkus.smallrye-jwt.blocking-authentication=true.

The next thing was to implement, as the documentation said, the JWTCallerPrincipalFactory. Now that this happens on the Worker thread there is no issue calling the DB to get my keys.

See: CustomJWTCallerPrincipalFactory and KeyResolver's customized JWTConsumer

Finally, the registry where the keys are looked up from the DB (the bean#method that invokes the active records) needs to be marked @Transactional.

See: StoredKeyPairRegistry

Chris Ruffalo
  • 1,903
  • 12
  • 17