Support for OIDC SPIFFE Client Authentication by sberyozkin · Pull Request #53773 · quarkusio/quarkus

sberyozkin · 2026-04-23T13:04:33Z

This PR adds support for using SPIFFE JWT tokens for the client authentication between Quarkus OIDC and providers such as Keycloak.

It builds upon the work done by @michalvavrik, with the demo work from @sabre1041 and @maia-iyer at https://github.com/sabre1041/keycloakcon-spiffe/ clarifying a typical pattern for using such tokens for the client authentication.

This PR will fix the linked issue.

As far as X509 client authentication is concerned, it is expected to work out of the box where the OIDC client certificate is located in the file, though I think we'll need to figure out how to handle the dynamism associated with such certificates being regularly refreshed. It will be another enhancement request

sberyozkin · 2026-04-23T14:16:15Z

I forgot to add a test resource, it caused the compilation failure.
Also, dismissed alerts as false postives, no actual token is logged, only its type

quarkus-bot · 2026-04-23T14:46:56Z

Status for workflow `Quarkus Documentation CI`

This is the status report for running Quarkus Documentation CI on commit 1e43f3b.

✅ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

Warning

There are other workflow runs running, you probably need to wait for their status before merging.

github-actions · 2026-04-23T14:50:45Z

🎊 PR Preview 7db3de4 has been successfully built and deployed to https://quarkus-pr-main-53773-preview.surge.sh/version/main/guides/

Images of blog posts older than 3 months are not available.
Newsletters older than 3 months are not available.

quarkus-bot · 2026-04-23T15:18:44Z

Status for workflow `Quarkus CI`

This is the status report for running Quarkus CI on commit 1e43f3b.

✅ The latest workflow run for the pull request has completed successfully.

It should be safe to merge provided you have a look at the other checks in the summary.

You can consult the Develocity build scans.

michalvavrik · 2026-04-23T16:07:50Z

I'll review sometimes tomorrow.

michalvavrik · 2026-04-24T13:18:42Z

            }
            if (clientAssertion == null) {
                String errorMessage = String.format(
                        "%s OidcClient can not complete the %s grant request because a JWT bearer client_assertion is missing",


this error message cannot say only "JWT bearer"

michalvavrik · 2026-04-24T13:20:33Z

                final String clientAssertion = clientAssertionProvider.getClientAssertion();
                if (clientAssertion == null) {
                    throw new OIDCException(String.format(
                            "Cannot get token for tenant '%s' because a JWT bearer client_assertion is not available",


now it is not just a JWT bearer, hence this err msg should be updated

michalvavrik · 2026-04-24T13:22:49Z

        this.responseFilters = responseFilters;
        this.clientSecretBasicAuthScheme = clientCredentials.clientSecretBasicAuthScheme;
-        this.jwtBearerAuthentication = oidcClientConfig.credentials().jwt().source() == Source.BEARER;
+        this.jwtBearerAuthentication = oidcClientConfig.credentials().jwt().source() != Source.CLIENT;


you are free to keep it as is, but if you can find a better name that reflects it is not only the jwt bearer auth, better

michalvavrik · 2026-04-24T13:25:09Z


            /**
             * Path to a file with a JWT bearer token that should be used as a client assertion.
             * This path can only be set when JWT source ({@link #source()}) is set to {@link Source#BEARER}.


SPIFFE is also allowed

michalvavrik · 2026-04-24T13:42:12Z

+        }
+
+        conf.put("code-flow-jwt-bearer-token-path", jwtBearerTokenPath.toString());
+        conf.put("code-flow-jwt-bearer-token", jwtBearerToken);


I didn't find this used anywhere?

michalvavrik · 2026-04-24T13:42:29Z

+        conf.put("code-flow-jwt-bearer-token-path", jwtBearerTokenPath.toString());
+        conf.put("code-flow-jwt-bearer-token", jwtBearerToken);
+        conf.put("code-flow-spiffe-token-path", spiffeSvidTokenPath.toString());
+        conf.put("code-flow-spiffe-token", spiffeSvidToken);


I also didn't find this to be used anywhere?

michalvavrik · 2026-04-24T13:50:21Z

+    private static void verifySpiffeId(JsonObject claims) {
+        String sub = claims != null ? claims.getString(Claims.sub.name()) : null;
+        if (sub == null || !sub.startsWith(SPIFFE_ID_SCHEME)) {
+            throw new IllegalStateException(


I think I had a good reason why I didn't want to throw an exception. Now I didn't verify this today, but I think this will be silently (or not silently?) swallowed and the old assertion will be kept. That is not what we want, we want it to be null, so that it is later considered io.quarkus.oidc.common.runtime.KubernetesServiceClientAssertionProvider#isInvalid (invalid)

Hi @michalvavrik there is a test but I will check

Hi @michalvavrik there is a test but I will check

so maybe it is considered as "expired", but my error log messages are logged. please check this exception is at least logged for user to know that something has happened, in which case it is fine

michalvavrik · 2026-04-24T13:51:32Z

    private static final Logger LOG = Logger.getLogger(KubernetesServiceClientAssertionProvider.class);
+    private static final String SPIFFE_ID_SCHEME = "spiffe://";
    private final Vertx vertx;
    private final Path bearerTokenPath;


that bearer doesn't really work? but I am fine with keeping it unless you know a better way?

@michalvavrik Can you clarify please?

never mind. I meant to comment on "jwtBearerToken" variables which are definitely elsewhere. this is member property is fine.

basically - we have a source which can be bearer or spiffe or .. and yes SPIFFE JWT-SVID is a JWT Bearer token, but it is also bit confusing to have a JWT bearer token marking both SPIFFE and BEARER.

but this is not a right place, let's keep it as is. thanks

Np, thanks @michalvavrik, I'll have a look and see what can be renamed. May be we can even make this class abstract and have typical bearer and spiffe token extensions, may be later

michalvavrik

I only run quickly through it + asked Claude to check it. I'll read it properly again when you address my comments. I already did a lot of unrelated reading today, so I need to check tonight. But I presume it will be fine. Thanks

sberyozkin · 2026-04-24T18:15:49Z

Thanks @michalvavrik , I'll have a look

michalvavrik · 2026-04-24T20:33:17Z

 }
 ----

+==== SPIFFE SVID


Are you certain that we should be using "SPIFFE SVID"? The way I see it the SVID document can be in JWT or x509 certificate format and you are only talking in this section about JWT-SVID. I tried to look it up and "SVID token" is almost never used. Only in https://spiffe.io/docs/latest/spiffe-specs/jwt-svid/ it says "token-based SVID".

The same term "SPIFFE SVID token" is used below as well. Same question for these occurrences.

michalvavrik

I checked again, looks fine. Let's address at least some of my comments and then we can ask George to review.

sberyozkin requested a review from michalvavrik April 23, 2026 13:04

sberyozkin temporarily deployed to ci April 23, 2026 13:04 — with GitHub Actions Inactive

sberyozkin added the release/noteworthy-feature label Apr 23, 2026

quarkus-bot Bot added area/docstyle issues related for manual docstyle review area/documentation area/oidc labels Apr 23, 2026

This comment has been minimized.

Sign in to view

github-advanced-security AI found potential problems Apr 23, 2026

View reviewed changes

Support for OIDC SPIFFE Client Authentication

1e43f3b

sberyozkin force-pushed the spiffe_client_authentication branch from 8998167 to 1e43f3b Compare April 23, 2026 14:15

sberyozkin temporarily deployed to ci April 23, 2026 14:15 — with GitHub Actions Inactive

michalvavrik reviewed Apr 24, 2026

View reviewed changes

Conversation

sberyozkin commented Apr 23, 2026

Uh oh!

This comment has been minimized.

This comment has been minimized.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sberyozkin commented Apr 23, 2026

Uh oh!

quarkus-bot Bot commented Apr 23, 2026

Status for workflow Quarkus Documentation CI

Uh oh!

github-actions Bot commented Apr 23, 2026

Uh oh!

quarkus-bot Bot commented Apr 23, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Status for workflow Quarkus CI

Uh oh!

michalvavrik commented Apr 23, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

michalvavrik left a comment

Choose a reason for hiding this comment

Uh oh!

sberyozkin commented Apr 24, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

michalvavrik left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Status for workflow `Quarkus Documentation CI`

quarkus-bot Bot commented Apr 23, 2026 •

edited by github-actions Bot

Loading

Status for workflow `Quarkus CI`