1.6. ステップアップ認証

package io.quarkus.it.oidc;

import io.quarkus.oidc.AuthenticationContext;
import io.quarkus.oidc.BearerTokenAuthentication;
import jakarta.ws.rs.GET;
import jakarta.ws.rs.Path;

@BearerTokenAuthentication
@Path("/")
public class GreetingsResource {

    @Path("hello")
    @AuthenticationContext("myACR") 

    @GET
    public String hello() {
        return "hello";
    }

    @Path("hi")
    @AuthenticationContext(value = "myACR", maxAge = "PT120m") 

    @GET
    public String hi() {
        return "hi";
    }
}

quarkus.http.auth.proactive=false 

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer error="insufficient_user_authentication",
 error_description="A different authentication level is required",
 acr_values="myACR"

quarkus.oidc.hr.token.required-claims.acr=myACR

package io.quarkus.it.oidc;

import java.util.Map;

import jakarta.enterprise.context.ApplicationScoped;

import org.jose4j.jwt.MalformedClaimException;
import org.jose4j.jwt.consumer.JwtContext;
import org.jose4j.jwt.consumer.Validator;

import io.quarkus.arc.Unremovable;
import io.quarkus.oidc.TenantFeature;
import io.quarkus.oidc.common.runtime.OidcConstants;
import io.quarkus.security.AuthenticationFailedException;

@Unremovable
@ApplicationScoped
@TenantFeature("hr")
public class AcrValueValidator implements Validator {

    @Override
    public String validate(JwtContext jwtContext) throws MalformedClaimException {
        var jwtClaims = jwtContext.getJwtClaims();
        if (jwtClaims.hasClaim("acr")) {
            var acrClaim = jwtClaims.getStringListClaimValue("acr");
            if (acrClaim.contains("myACR") && acrClaim.contains("yourACR")) {
                return null;
            }
        }
        String requiredAcrValues = "myACR,yourACR";
        throw new AuthenticationFailedException(Map.of(OidcConstants.ACR_VALUES, requiredAcrValues));
    }
}