Keycloak Claim Information Point - NPE when trying to read body

When you try to read body through Claim Information Point the result is Null Pointer Exception.

When you add the following to your application.properties file:

quarkus.keycloak.policy-enforcer.claim-information-point.claims.claim-from-body={request.body}

And execute the post request against the endpoint /api/auth-entry

The result is:

ERROR: HTTP Request to /api/auth-entry failed, error id: d73bb86a-aa3e-40bc-9497-7683a11b1a92-1
java.lang.NullPointerException
	at io.quarkus.keycloak.pep.VertxHttpFacade$1.getInputStream(VertxHttpFacade.java:124)
	at org.keycloak.adapters.authorization.util.RequestPlaceHolderResolver.resolve(RequestPlaceHolderResolver.java:107)
	at org.keycloak.adapters.authorization.util.PlaceHolders.parsePlaceHolders(PlaceHolders.java:93)
	at org.keycloak.adapters.authorization.util.PlaceHolders.resolve(PlaceHolders.java:45)

Here is the Sample Project

You can create the quarkus realm from src/test/resources/keycloack/quarkus-realm.json file.

Then you can retrieve the token for user (alice/alice) as described here: https://quarkus.io/guides/security-keycloak-authorization

Then you have to put the token in org.otaibe.enforcer.claim.can.not.read.body.web.controller.RestControllerTest#TOKEN

If you execute the test org.otaibe.enforcer.claim.can.not.read.body.web.controller.RestControllerTest#testPostEndpoint

Then you will receive the NPE

[pedroigor]

@gsmet Looking …

[tpenakov]

@pedroigor - I need your help here 😃 I’ve tried to add a custom ClaimInformationPointProvider. The provider is dummy and just read the request body and log it to the console. It is updated in the same sample test project. The provider class is: org.otaibe.enforcer.claim.can.not.read.body.cip.FhirClaimInformationPointProvider I’ve figured out that the correct way to read the request body and then to be able to reuse it is through httpFacade.getRequest().getInputStream(true) It worked fine in the sample test project, but when I’ve tried to port the same code in the real project it stopped to work. The reason was: In the test project httpFacade.getRequest().getInputStream(true) returns ByteArrayInputStream, but on the real one it returns VertxInputStream. The first one allow multiple reads, but the second one doesn’t. After a while I’ve managed to make my real project to work too, but this was like a magic to me 😃 If I add this line to the application.properties file the body is buffered and can be read correctly:

quarkus.keycloak.policy-enforcer.claim-information-point.claims.claim-from-body={request.body}

After commented the very same line in the sample test project it stopped to work too.

I understand that this workaround with adding the line to the application.properties file will do the trick for me, but it will be great if you help me to enforce the same behavior in the correct way?

Could you please help me with that?