oidc-client ContextNotActiveException in new thread

[lthasle]

Our application is working fine with oidc-client authorization.

It is implemented according to this: https://quarkus.io/guides/security-openid-connect-client#named-oidc-clients

But if our oidc authorization is performed in a new Thread, it fails, with:
Caused by: javax.enterprise.context.ContextNotActiveException at io.quarkus.arc.impl.ClientProxies.getDelegate(ClientProxies.java:46) at io.quarkus.oidc.client.runtime.TokensProducer_MidtNorge_ProducerMethod_produceTokens_494654c3bfa2346b017c24e2e2c4fcfc99087d0e_ClientProxy.arc$delegate(Unknown Source) at io.quarkus.oidc.client.runtime.TokensProducer_MidtNorge_ProducerMethod_produceTokens_494654c3bfa2346b017c24e2e2c4fcfc99087d0e_ClientProxy.getAccessToken(Unknown Source) at sb1.fip.app.bsf.online.meglersystem.adapter.stream.StreamAuthenticationFilterMidtNorge.filter(StreamAuthenticationFilterMidtNorge.java:25) at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.filterRequest(ClientInvocation.java:767) ... 41 more

Any suggestion on how to solve this?

Our code:

``
@priority(Priorities.AUTHENTICATION)
public class StreamAuthenticationFilterMidtNorge implements ClientRequestFilter {

@NamedOidcClient("MidtNorge")
Tokens tokens;

@Override
public void filter(ClientRequestContext clientRequestContext) throws IOException {
    clientRequestContext.getHeaders().add(HttpHeaders.AUTHORIZATION, "Bearer " + tokens.getAccessToken());
}

}

@RegisterRestClient(configKey = "stream.api.midtnorge")
@RegisterProvider(StreamAuthenticationFilterMidtNorge.class)
public interface StreamClientMidtNorge extends StreamClient {}
``

Maybe something like the following could be used?:
Tokens tokens = Arc.container().instance(MyNamedToken??.class).get(); or
Tokens tokens = CDI.current().select(MyNamedToken??.class).get();
But the problem is: what class(MyNamedToken??) to use?

I have tried a couple of things:
Adding dependency: quarkus-oidc-token-propagation
Add this properties:
quarkus.oidc-token-propagation.enabled=true
quarkus.oidc-token-propagation.exchange-token=true
quarkus.oidc-token-propagation.client-name=MidtNorge
quarkus.oidc-token-propagation.register-filter=true
But this don't help either.

The reason to that we change the thread is that we put the incoming request to a queue, and then process the request from the queue, but then in a new thread.
We are not able to use https://quarkus.io/guides/jms, so we use another dependency:
activemq-client from org.apache.activemq.
Changing thread with the use of ManagedExecutor works fine

We are using Quarkus 2.5.3.Final RestEasy classic.
But it also fails in previous version.

[sberyozkin]

@lthasle you probably need to add the context propagation, oidc-token-propagation adds an incoming already existing token to the outbound request so it won't help in this case, please see https://quarkus.io/guides/security-customization#reactive-security

[lthasle]

Thanks for the proposal, but I already had the dependency:
quarkus-smallrye-context-propagation
on the classpath, so that doesn't help unfortunately.

Instead of injecting it, is there a programmatic way to obtain the value(tokens)?

[sberyozkin]

@lthasle Not With OidcClient (I'd not like to recommend going the route of creating OidcClientImpl manually). You can use a Reactive or Vertx client to create a simple form request if you'd like. But we should also figure out why ContextNotActiveException is still happening. Can you please create a simple reproducer and open an issue ? thanks

[lthasle]

@sberyozkin Thanks for your help, I created an issiue: #22477