4.x - SecurityCdiExtension should honor enabled=false for providers

[romain-grecourt]

Environment Details

• Helidon Version: 4.0.6
• Helidon MP

---

Problem Description

io.helidon.microprofile:helidon-microprofile-oidc always require configuration (see #8493) ; when trying to set security.providers.0.oidc.enabled=false SecurityCdiExtension fails with the following exception:

Exception in thread "main" java.lang.IllegalArgumentException: OidcConfig must be configured
	at io.helidon.security.providers.oidc.OidcProvider$Builder.build(OidcProvider.java:270)
	at io.helidon.security.providers.oidc.OidcProvider.create(OidcProvider.java:105)
	at io.helidon.security.providers.oidc.OidcProviderService.providerInstance(OidcProviderService.java:45)
	at io.helidon.security.Security$Builder.providerFromConfig(Security.java:1124)
	at io.helidon.security.Security$Builder.lambda$fromConfig$1(Security.java:979)
	at java.base/java.lang.Iterable.forEach(Iterable.java:75)
	at io.helidon.security.Security$Builder.lambda$fromConfig$2(Security.java:979)
	at java.base/java.util.Optional.ifPresent(Optional.java:178)
	at io.helidon.common.mapper.OptionalValue.ifPresent(OptionalValue.java:188)
	at io.helidon.security.Security$Builder.fromConfig(Security.java:978)
	at io.helidon.security.Security$Builder.config(Security.java:838)
	at io.helidon.microprofile.security.SecurityCdiExtension.configure(SecurityCdiExtension.java:95)

Note that the enabled property is specific to the Oidc provider, instead this should a be a generic mechanism that can be used with any providers and that should be honored when discovering providers either via ServiceLoader or with CDI.

Steps to reproduce

Add the following dependency:

<dependency>
    <groupId>io.helidon.microprofile</groupId>
    <artifactId>helidon-microprofile-oidc</artifactId>
</dependency>

Add the following configuration:

security:
  providers:
    - oidc:
        enabled: false

[tomas-langer]

Solution: if enabled: false is set in configuration of a security provider, that provider instance will not be created and it will be ignored by security, as if it was not defined at all.