Quarkus Casdoor Auth
Casdoor is an open-source identity and access management platform with OAuth 2.0, OIDC, SAML, LDAP and Casbin-based permissions.
This extension builds on quarkus-oidc, which handles sign-in and token verification, and adds what is specific to Casdoor:
-
the names of the user’s Casdoor roles become Quarkus roles, so
@RolesAllowedworks; -
@PermissionsAllowed("resource:action")is checked against Casdoor permissions with the Casdoor/api/enforceAPI; -
an HTTP security policy named
casdoorchecks the request path and method against Casdoor permissions.
Installation
To use this extension, add the io.quarkiverse.casdoor-auth:quarkus-casdoor-auth dependency to your build file.
With Maven, add the following to your pom.xml:
<dependency>
<groupId>io.quarkiverse.casdoor-auth</groupId>
<artifactId>quarkus-casdoor-auth</artifactId>
<version>0.1.0</version>
</dependency>With Gradle, add the following to your build.gradle:
implementation("io.quarkiverse.casdoor-auth:quarkus-casdoor-auth:0.1.0")The extension brings in quarkus-oidc, so you do not need to add it.
Configuring sign-in
Create an application in Casdoor, add your application’s callback URL (for example http://localhost:8080/) to its redirect URLs, and copy its client ID and client secret.
Then configure quarkus-oidc with the Casdoor server and the application’s credentials:
quarkus.oidc.auth-server-url=https://door.casdoor.com
quarkus.oidc.client-id=<client ID>
quarkus.oidc.credentials.secret=<client secret>
# web-app: redirect users to the Casdoor sign-in page; service (the default): accept bearer tokens only
quarkus.oidc.application-type=web-appCasdoor publishes its OIDC discovery document at /.well-known/openid-configuration, so nothing else is needed.
See the OIDC code flow and OIDC bearer token guides for all quarkus.oidc options.
The identity has two extra attributes, casdoor.organization and casdoor.username, read from the owner claim and the name (or preferred_username) claim of the token.
Roles
The names of the user’s Casdoor roles are added to the identity:
@GET
@RolesAllowed("admin")
public String admin() {
return "admin";
}Casdoor’s default JWT token format puts the roles in the token.
With the JWT-Standard format the token has no roles, and they are read from the UserInfo response instead; enable it with quarkus.oidc.authentication.user-info-required=true.
Casdoor groups are in the standard groups claim, which quarkus-oidc already maps to roles.
Permissions
@PermissionsAllowed is checked with Casdoor. @PermissionsAllowed("data1:read") sends the Casbin request ["<organization>/<username>", "data1", "read"] to Casdoor and allows the call if a Casdoor permission allows it:
@GET
@PermissionsAllowed("data1:read")
public String data1() {
return "data1";
}By default all permissions of the user’s organization are checked. To check a single permission, model, resource or enforcer, set one of:
quarkus.casdoor.authorization.permission-id=my-org/my-permission
# quarkus.casdoor.authorization.model-id=my-org/my-model
# quarkus.casdoor.authorization.resource-id=my-resource
# quarkus.casdoor.authorization.enforcer-id=my-org/my-enforcerThe extension calls Casdoor with the application’s client ID and secret, so the permission, model or enforcer must belong to the application’s organization.
Path-based authorization
The casdoor HTTP security policy sends ["<organization>/<username>", "<path>", "<method>"], for example ["my-org/alice", "/api/orders", "GET"], so a Casdoor permission with resources /api/orders and actions GET controls access to that endpoint.
Apply it to paths:
quarkus.http.auth.permission.casdoor.paths=/api/*
quarkus.http.auth.permission.casdoor.policy=casdooror to endpoints:
@GET
@AuthorizationPolicy(name = "casdoor")
public String orders() {
return "orders";
}Anonymous requests are denied.
Caching
Each check calls Casdoor. To cache results, set quarkus.casdoor.authorization.cache-ttl, for example to 30S; permission changes in Casdoor then take up to that long to apply.
Extension Configuration Reference
Configuration property fixed at build time - All other configuration properties are overridable at runtime
Configuration property |
Type |
Default |
|---|---|---|
Base URL of the Casdoor server, for example Environment variable: |
string |
|
Client ID used to call the Casdoor API. Defaults to Environment variable: |
string |
|
Client secret used to call the Casdoor API. Defaults to Environment variable: |
string |
|
Add the names of the user’s Casdoor roles to the security identity, so that Environment variable: |
boolean |
|
Check Environment variable: |
boolean |
|
Casdoor permission to enforce, as Set at most one of Environment variable: |
string |
|
Casdoor model whose permissions are enforced, as Environment variable: |
string |
|
Casdoor resource whose permissions are enforced. Environment variable: |
string |
|
Casdoor enforcer to use, as Environment variable: |
string |
|
How long an enforce result is cached. Environment variable: |
|
|
Timeout of a call to the Casdoor API. Environment variable: |
|
|
About the Duration format
To write duration values, use the standard You can also use a simplified format, starting with a number:
In other cases, the simplified format is translated to the
|