Authenticate all OpenLiberty end-points through JWT

Question

I have a setup such that end-points annotated with @RolesAllowed require both authentication and authorization. However, those end-points without any particular annotation don't even demand authentication. How do I configure the server such that all URLs are protected by default, requiring at least a logged-in user?

Answer 1

UPDATE No easy solution so far. Still looking for easier approach.

You can do something like this but it requires modifying server.xml and all jax-rs resource classes:

In the server.xml provide role binding (similar could be done via ibm-web-bnd.xml file):

<application-bnd>
  <!-- role from JWT claim. The access-id must have your claim issuer. In my case it was mp.jwt.verify.issuer=http://openliberty.io   --> 

    <security-role name="admin">
        <group access-id="group:http://openliberty.io/admin" id="group1" name="admin" />
    </security-role>
 <!-- role for authenticated users -->
    <security-role name="auth-user">
        <special-subject type="ALL_AUTHENTICATED_USERS" />
    </security-role>
</application-bnd>

And in your resource class you need to define role for all authenticated. I defined it on top of the class like this, as this protects all methods without @RolesAllowed defined explicitly:

@RolesAllowed({ "auth-user" })
public class SystemResource {

Answer 2

Note: The following works when using Liberty's proprietary openIdConnectClient feature, but not mpJWT. For mpJWT, the security constraints conflict with mpJWT. There have been issues opened for it against OpenLiberty, but it's not likely to be resolved until mpJWT moves into Jakarta Security.

The easiest (but still not easy) way of requiring authentication for all endpoints is to set up security constraints in the web.xml file:

<security-constraint>
  <web-resource-collection>
    <web-resource-name>ProtectAll</web-resource-name>
    <url-pattern>/*</url-pattern>
    <http-method>GET</http-method>
    <!-- repeat for PUT, POST, PATCH, etc -->
  </web-resource-collection>
  <auth-constraint>
    <role-name>all-authenticated</role-name>
  </auth-constraint>
</security-constraint>

and then as @Gas mentions, you would need to create a mapping from Liberty's ALL_AUTHENTICATED_USERS special subject to the all-authenticated role name:

<application ..[snip]..>
  <application-bnd>
    <security-role name="all-authenticated">
      <special-subject type="ALL_AUTHENTICATED_USERS" />
    </security-role>
  </application-bnd>
</application>

The combination of these two bits of configuration will tell Liberty to protect all URLs hosted in this web module.

One thing to be mindful of is that this will protect observability endpoints like /health, /metrics, etc. If your monitoring systems require unauthenticated access, you'd want to add an additional security constraint that assigns those resources to a role that maps to Liberty's EVERYONE special subject.

Answer 3

In the end I opted for the following filter, which I thought was simpler and more explicit than the alternatives proposed so far:

import jakarta.inject.Inject;
import jakarta.ws.rs.NotAuthorizedException;
import jakarta.ws.rs.container.ContainerRequestContext;
import jakarta.ws.rs.container.ContainerRequestFilter;
import jakarta.ws.rs.ext.Provider;
import org.eclipse.microprofile.jwt.JsonWebToken;

@Provider
public class AuthFilter implements ContainerRequestFilter {

    @Inject
    private JsonWebToken jwt;

    @Override
    public void filter(ContainerRequestContext req) {
        var isAuthenticated = jwt != null && jwt.getName() != null && jwt.getGroups() != null;
        if (!isAuthenticated) {
            throw new NotAuthorizedException("Authentication required.");
        }
    }
}