Fix NPE when OIDC TenantConfigResolver returns null

[sberyozkin]

Fixes #32449.

If a custom OIDC TenantConfigResolver returns null, as opposed to Uni.createFrom().nullitem(), Uni memoize function will throw NPE, leading, in the linked issue, to 500. So this PR only adds a null check before calling memoize, and updates the test to confirm that returning both null and Uni.createFrom().nullitem() lead to 401 when the current URL can not be used to resolve a valid tenant

[sberyozkin]

Oops, 1 sec, redundant update got in

[sberyozkin]

Ready now

[gastaldi]

Are custom TenantConfigResolver impls allowed to return null? Curious if we shouldn't throw an IllegalStateException or have the error logged since it seems to be a code issue

[quarkus-bot]

✔️ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

[sberyozkin]

Hi @gastaldi

Are custom TenantConfigResolver impls allowed to return null? Curious if we shouldn't throw an IllegalStateException or have the error logged since it seems to be a code issue

We have agreed with @pedroigor when we were looking into the multi-tenancy support that when custom resolvers return null, the fallback goes to the default tenant, and it is being tested, the resolvers are expected to return Uni null item but if they return null it should also work.

FYI, here is an example of the default and custom tenant:

# Default Tenant Configuration
%prod.quarkus.oidc.auth-server-url=http://localhost:8180/realms/quarkus
quarkus.oidc.client-id=default-client
quarkus.oidc.application-type=web-app

# Tenant A Configuration
quarkus.oidc.tenant-a.auth-server-url=http://localhost:8180/realms/tenant-a
quarkus.oidc.tenant-a.client-id=tenant-a-client
quarkus.oidc.tenant-a.application-type=web-app

tenant-a is a statically configured custom tenant - these are resolved with TenantResolver.
But tenant-a can also be created dynamically in the code, in TenantConfigResolver as in the linked issue.
Whichever way it is created, if the resolver returns null or a Uni null item, the default tenant has to be picked up.
If the default tenant is disabled and TenantConfigResolver returns null then OIDC simply does not create SecurityIdentity - and 401 is reported

HTH to clarify a few details :-)