Skip to content

Conversation

@AlexisSouquiere
Copy link
Collaborator

Fix #1621
Fix #1585

After rewriting the authorization feature, the JWT token contains now more information than before (clusters regex for instance).

The 4Kb cookie constraint is invariant unless we change the micronaut.security.authentication.cookie to bearer to store the JWT token in the browser storage and send in in the Authorization header.

Some users raised that AKHQ doesn't work with bearer auth and OIDC providers like Keycloak. So no way exists to help them managing complex user permissions.

I propose to setup a JWT payload GZIP compression to reduce the JWT token size and hopefully, solve issues raised previously. Tests that I did with a real use case that we had in my company (that forced us to use bearer auth) are promising. It's compatible with all the authentication mechanisms (basic, ldap, oidc, etc.) because the compression is done by extending the JWTClaimsSetGenerator that creates the JWT token

Even if the JWT payload compression isn't standard for signed JWT, it's used by libraries like JJWT

@AlexisSouquiere AlexisSouquiere marked this pull request as draft December 11, 2023 13:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

External roles and attributes mapping breaking if patterns are too long Error 502 with k8s and keycloak

2 participants