SecurityIdentity and Permissions

[celcius112]

Hello,

I have a use case where I need to retrieve all permissions of the currently authenticated user — something like securityIdentity.getPermissions(), and "do stuff" programmatically.

However, this doesn’t seem possible since permissions are encapsulated by the permission checker function. One idea I had was to decorate the default SecurityIdentity with a custom implementation that exposes a getPermissions() method. This would work since we populate the permissions ourselves.

The issue is that this approach doesn’t integrate well with @TestSecurity(permissions = ...), and I haven’t found a solution that works consistently across both production and test code.

Another possible solution would be to add permissions to the roles collection as well. However, this feels like a workaround and suffers from the same testing issue as the previous approach.

Any suggestions or guidance would be greatly appreciated!

[quarkus-bot[bot]]

/cc @sberyozkin (security)

[sberyozkin]

@celcius112 We have a rather old PR at quarkusio/quarkus-security#57, I think your post gives us stimulus to actually go ahead and complete it, at least the part that lists permissions

[celcius112]

Thank you for the reply. This is exactly what I would need !

[michalvavrik]

Thank you for the reply. This is exactly what I would need !

Can you give me an idea why do you need it? I wonder how is that collection of permissions used and I'd like to understand your use case. Thank you

[sberyozkin]

@michalvavrik Michal, like I said, IMHO we should just treat them as SecurityIdentity properties, same way we do it with roles, as far as letting users check what permissions are associated with the identity.

They may do whatever they want with this list, store them in the database or whatever, how some registered permission checker checks them is orthogonal.

[michalvavrik]

ok