Smallrye JWT isn't compatible with native image #3496
Comments
|
@aesteve Hi, not sure yet if the JNI issue is only the first one, please see this guide, but can you try to enable JNI and see how it goes ? |
|
In fact, it's the whole @sberyozkin I think the SmallRye JWT extension should produce a |
|
Hi @gsmet thanks for the advice, yes if |
|
@sberyozkin is it a runtime config or build time config? |
|
Well, in any case, it should be runtime to be easily overridable. So maybe we should leave it at that. @sberyozkin could you add a note in the documentation just after the config property table? |
|
@gsmet will do and post to this issue once I'm done, finalizing the other PR right now, thanks |
|
Hi and thanks for your answers. So if I understand correctly, since the endpoint where JWKS is located is using https, thus JNI, which is not configured in my application. I'll try to add it and see how it goes. |
|
To be clearer: you need SSL support as you are connecting to a https URL, it's not enabled by default as it makes the native images significantly larger. You need to define the following property in your It will enable JNI and more. Note that if you want to create a Docker container supporting SSL, you should refer to https://quarkus.io/guides/native-and-ssl-guide for more details. |
|
Thanks for the link, so I have other things to add in addition to the properties option. I'm gonna try. A small note in addition, I have been surprised to face that issue when a request hits the server and not at startup. It makes sense if the JWT check is lazy, and therefore JWKS are not read when application starts. Why not, but I'd like to be sure that those JWKS are stored in a cache and not accessed every time a request header needs to be checked. I didn't find the source on smallrye-jwt could someone point me at this ? |
|
The sources are here: https://github.com/smallrye/smallrye-jwt/ . Not familiar with this project so I can't help you on that. |
|
Sorry for the report :\ As for the caching thing, I may ask for help on the repo you linked right above this comment. Thanks a lot. |
|
@aesteve we definitely need a pointer in the JWT doc though so we will add one. |
gsmet
added
kind/question
|
@aesteve ping me please if you have any questions re smallrye-jwt. The key resolution is typically done once, inside Jose4J key location resolver. HTTPS located keys are managed by Jose4J HTTPS cache. I've provided the details at smallrye/smallrye-jwt#118, cheers |
Describe the bug
Securing APIs through the smallrye-jwt extension works fine in dev mode (and I'm guessing jar mode is OK too) but fails with an exception when used in a native image.
Expected behavior
It should work the same way in native mode than in dev mode, and not fail with an exception
Actual behavior
To Reproduce
Steps to reproduce the behavior:
Follow the tutorial and build a native image.
Then execute it and try to access any secured endpoint. You'll get the stacktrace above.
Configuration
Basically the same as in the tutorial, but adapted to a real-life use-case I'm not able to share.
Environment (please complete the following information):
uname -aorver: Linux <> 4.14.127+ Switch to the Maven distributed copy of the SubstrateVM annotations #1 SMP Tue Jun 18 18:32:10 PDT 2019 x86_64 GNU/Linuxjava -version: bash: java: command not found (native image pod)The text was updated successfully, but these errors were encountered: