[jira] [Created] (ARTEMIS-6093) Hawtio OIDC authentication module fails on token exchange loop due to browser CORS policies on cross-site public clients.

["Guruprasad (Jira)" <ji...@apache.org>]

Guruprasad created ARTEMIS-6093:
-----------------------------------

             Summary: Hawtio OIDC authentication module fails on token exchange loop due to browser CORS policies on cross-site public clients.
                 Key: ARTEMIS-6093
                 URL: https://issues.apache.org/jira/browse/ARTEMIS-6093
             Project: Artemis
          Issue Type: Bug
    Affects Versions: 2.54.0
         Environment: Target Framework: Apache ActiveMQ Artemis 2.54.0 bundle

Embedded Web Dashboard Provider: Hawtio v4.7.0 UI engine 

Target Platform: Cloud Orchestration Container Platform running non-root restricted runtime policies. 

Identity Standard: OpenID Connect (OIDC) Authorization Code Flow utilizing Public Client registrations.
            Reporter: Guruprasad


Hawtio Console OIDC Authentication Failure with Public Clients (PKCE)

Description:
We are encountering an authentication loop and CORS validation blocking errors when attempting to run Hawtio consoles (v4.7.0) alongside embedded server environments behind enterprise ingress patterns (e.g., Kubernetes/OpenShift routes).

Configuration Setup:
- Platform: Kubernetes / OpenShift
- OIDC Provider: Corporate Identity Provider (using Public Client PKCE Profiles, no static global Client Secret available).
- Hawtio Configuration Mode: Tried both 'embedded' and 'local'.

Observed Errors:
1. Browser Console captures a strict Cross-Origin Resource Sharing (CORS) standards violation block when making direct client-side fetch requests to the token endpoint:
"Access to fetch at 'https://<IDENTITY_PROVIDER>/as/token.oauth2' from origin 'https://<APP_ROUTE>' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource."

2. When attempting server-side exchanges, passing the public client token generation parameters into a standard `client_secret` target configuration field yields an HTTP 400 Bad Request error from the identity broker.

Steps to Reproduce:
1. Configure an embedded broker console chart with standard OIDCLoginModule parameters.
2. Launch authentication via a client proxy mapping that relies on a public client setup.
3. Observe token fetch processing redirection boundaries fail automatically because the single-page application structure bypasses server-to-server forwarding channels.

Expected Behavior:
Hawtio should gracefully allow explicit configuration configurations to route token resolution requests securely via its internal java reverse-proxy pipeline backend engine when configured in proxy mode, eliminating client-side cross-origin browser validation locks for public/PKCE token architectures.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@artemis.apache.org
For additional commands, e-mail: issues-help@artemis.apache.org