fix: invoke callback and complete on auth failure

gravitee-io · Nov 25, 2024 · 121bfeb · 121bfeb
1 parent f9f3617
commit 121bfeb
Showing 1 changed file with 10 additions and 1 deletion.
diff --git a/src/main/java/io/gravitee/policy/oauth2/Oauth2Policy.java b/src/main/java/io/gravitee/policy/oauth2/Oauth2Policy.java
@@ -180,7 +180,7 @@ public Completable authenticate(KafkaConnectionContext ctx) {
                                 extractedToken,
                                 Set.of(), // Scopes are fully managed by Gravitee, it is useless to extract & provide them to the Kafka security context.
                                 (expirationTime == null ? Long.MAX_VALUE : expirationTime),
-                                user,
+                                user != null ? user : "unknown",
                                 issueTime
                             );
 
@@ -189,6 +189,15 @@ public Completable authenticate(KafkaConnectionContext ctx) {
                     }
                 })
             )
+            .onErrorResumeNext(throwable -> {
+                Callback[] callbacks = ctx.callbacks();
+                for (Callback callback : callbacks) {
+                    if (callback instanceof OAuthBearerValidatorCallback oauthCallback) {
+                        oauthCallback.error("invalid_token", null, null);
+                    }
+                }
+                return Completable.complete();
+            })
             .doAfterTerminate(() -> ctx.removeInternalAttribute(ATTR_INTERNAL_TOKEN_INTROSPECTION_RESULT));
     }