为什么Quarkus JWT在每个endpoint上都未经授权返回

Question

我正在尝试用JWT保护我的Quarkus API。提供了JWT（代码段:承载EYJHBGCIOIJSUZI1NIISINR5CCIGOIAISLDUI[...])。

@Path("/quiz")
@RequestScoped
public class SomeResource {
  @Inject
  JsonWebToken jwt;

  @POST
  @RolesAllowed({"magister"})
  @Path("/save")
  @Consumes("application/json")
  @Produces("*/*")
  @Transactional
  public Response save(@RequestBody Quiz quiz) { }

  @GET
  @PermitAll
  @Path("/get/all")
  @Produces("application/json")
  public Response getAll(){ }

两个endpoint(@permitall和@rolesalloved)都返回一个HTTP401（未经授权）。

你知道为什么吗？我以为@permitall允许每一个请求？即使我的令牌证明我有所需的角色：

json prettyprint-override">"resource_access" : {
  "client_interface" : {
    "roles" : ["magister"]
  },
  ...
}

编辑：发现MicroProfile规范说

"groups":["magister"]

{
  [...]
  "resource_access": {
    "client_interface": {
      "roles": [
        "magister"
      ]
    },
    "account": {
      "roles": [
        "manage-account",
        "manage-account-links",
        "view-profile"
      ]
    }
  },
  "scope": "profile email",
  "email_verified": false,
  "groups": [
    "magister"
  ],
  "preferred_username": "magister"
}

Answer 1

我也有同样的问题，我通过添加以下代码修复了它：

@OpenAPIDefinition(
        info = @Info(
                title = "Title API",
                version = "1.0.0",
                description = "Description API"
        ),
        security = @SecurityRequirement(name = "jwt"),
        components = @Components(
                securitySchemes = {
                        @SecurityScheme(
                                securitySchemeName = "jwt",
                                description = "Token JWT",
                                type = SecuritySchemeType.HTTP,
                                scheme = "bearer",
                                bearerFormat = "jwt"
                        )
                }
        )
)

并将Quarkus更新到1.12.0.final版本