Skip to content

Commit 52bdad5

Browse files
sberyozkinsberyozkin
committed
Update vertex-ai-gemini to check OIDC TokenCredential
1 parent f55be2a commit 52bdad5

15 files changed

Lines changed: 536 additions & 3 deletions

File tree

‎docs/modules/ROOT/pages/includes/attributes.adoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
:project-version: 0.14.1
22
:langchain4j-version: 0.31.0
3-
:examples-dir: ./../examples/
3+
:examples-dir: ./../examples/

‎model-providers/vertex-ai-gemini/runtime/pom.xml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,11 @@
2323
<artifactId>quarkus-rest-client-reactive-jackson</artifactId>
2424
</dependency>
2525

26+
<dependency>
27+
<groupId>io.quarkus.security</groupId>
28+
<artifactId>quarkus-security</artifactId>
29+
</dependency>
30+
2631
<dependency>
2732
<groupId>com.google.auth</groupId>
2833
<artifactId>google-auth-library-oauth2-http</artifactId>

‎model-providers/vertex-ai-gemini/runtime/src/main/java/io/quarkiverse/langchain4j/vertexai/runtime/gemini/VertxAiGeminiRestApi.java‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@
1010
import java.util.regex.Pattern;
1111

1212
import jakarta.enterprise.context.ApplicationScoped;
13+
import jakarta.enterprise.inject.Instance;
14+
import jakarta.inject.Inject;
1315
import jakarta.ws.rs.BeanParam;
1416
import jakarta.ws.rs.POST;
1517
import jakarta.ws.rs.Path;
@@ -25,8 +27,10 @@
2527
import com.fasterxml.jackson.databind.ObjectMapper;
2628
import com.google.auth.oauth2.GoogleCredentials;
2729

30+
import io.quarkiverse.langchain4j.vertexai.runtime.gemini.config.LangChain4jVertexAiGeminiConfig;
2831
import io.quarkus.arc.DefaultBean;
2932
import io.quarkus.rest.client.reactive.jackson.ClientObjectMapper;
33+
import io.quarkus.security.credential.TokenCredential;
3034
import io.vertx.core.Handler;
3135
import io.vertx.core.MultiMap;
3236
import io.vertx.core.buffer.Buffer;
@@ -128,6 +132,12 @@ class TokenFilter implements ResteasyReactiveClientRequestFilter {
128132
private final ExecutorService executorService;
129133
private final AuthProvider authProvider;
130134

135+
@Inject
136+
Instance<TokenCredential> tokenCredential;
137+
138+
@Inject
139+
Instance<LangChain4jVertexAiGeminiConfig> configInstance;
140+
131141
public TokenFilter(ExecutorService executorService, AuthProvider authProvider) {
132142
this.executorService = executorService;
133143
this.authProvider = authProvider;
@@ -136,11 +146,16 @@ public TokenFilter(ExecutorService executorService, AuthProvider authProvider) {
136146
@Override
137147
public void filter(ResteasyReactiveClientRequestContext context) {
138148
context.suspend();
149+
final LangChain4jVertexAiGeminiConfig config = configInstance.isResolvable() ? configInstance.get() : null;
150+
final String currentToken = config != null && config.useSecurityIdentityToken() && tokenCredential.isResolvable()
151+
? tokenCredential.get().getToken()
152+
: null;
139153
executorService.submit(new Runnable() {
140154
@Override
141155
public void run() {
142156
try {
143-
context.getHeaders().add("Authorization", "Bearer " + authProvider.getBearerToken());
157+
context.getHeaders().add("Authorization", "Bearer " +
158+
(currentToken != null ? currentToken : authProvider.getBearerToken()));
144159
context.resume();
145160
} catch (Exception e) {
146161
context.resume(e);

‎model-providers/vertex-ai-gemini/runtime/src/main/java/io/quarkiverse/langchain4j/vertexai/runtime/gemini/config/LangChain4jVertexAiGeminiConfig.java‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ interface VertexAiGeminiConfig {
6060
Optional<String> baseUrl();
6161

6262
/**
63-
* Whether to enable the integration. Defaults to {@code true}, which means requests are made to the Anthropic
63+
* Whether to enable the integration. Defaults to {@code true}, which means requests are made to the Vertex AI
6464
* provider.
6565
* Set to {@code false} to disable all requests.
6666
*/
@@ -86,4 +86,13 @@ interface VertexAiGeminiConfig {
8686
*/
8787
ChatModelConfig chatModel();
8888
}
89+
90+
/**
91+
* Whether to use the current security identity's access token to access Vertex AI provider.
92+
* If it is set to {@code true} but the security identity has no access token then default Google application credentials
93+
* which must be setup in your environment will be used.
94+
* Set to {@code false} to access Vertex AI provider only with the default Google application credentials.
95+
*/
96+
@WithDefault("true")
97+
Boolean useSecurityIdentityToken();
8998
}

‎pom.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -202,6 +202,7 @@
202202
<module>samples/chatbot</module>
203203
<module>samples/chatbot-easy-rag</module>
204204
<module>samples/sql-chatbot</module>
205+
<module>samples/secure-vertex-ai-gemini-poem</module>
205206
</modules>
206207
</profile>
207208
</profiles>

‎samples/secure-vertex-ai-gemini-poem/README.md‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
# Secure Vertex AI Gemini Poem Demo
2+
3+
This demo showcases the implementation of a secure Vertex AI Gemini Poem Demo which is available only to users authenticated with Google.
4+
5+
## The Demo
6+
7+
### Setup
8+
9+
The demo asks Vertex AI Gemini LLM to write a short 1 paragraph poem, using the access token acquired during the OIDC authorization code flow.
10+
11+
### AI Service
12+
13+
This demo leverages the AI service abstraction, with the interaction between the LLM and the application handled through the AIService interface.
14+
15+
The `io.quarkiverse.langchain4j.sample.PoemAiService` interface uses specific annotations to define the LLM:
16+
17+
```java
18+
package io.quarkiverse.langchain4j.sample;
19+
20+
import dev.langchain4j.service.SystemMessage;
21+
import dev.langchain4j.service.UserMessage;
22+
import io.quarkiverse.langchain4j.RegisterAiService;
23+
24+
@RegisterAiService
25+
public interface PoemAiService {
26+
27+
/**
28+
* Ask the LLM to create a poem about Enterprise Java.
29+
*
30+
* @return the poem
31+
*/
32+
@SystemMessage("You are a professional poet")
33+
@UserMessage("""
34+
Write a short 1 paragraph poem about Java. Set an author name to the model name which created the poem.
35+
""")
36+
String writeAPoem();
37+
38+
}
39+
40+
### Using the AI service
41+
42+
Once defined, you can inject the AI service as a regular bean, and use it:
43+
44+
```java
45+
package io.quarkiverse.langchain4j.sample;
46+
47+
import java.net.URISyntaxException;
48+
49+
import io.quarkus.security.Authenticated;
50+
import jakarta.ws.rs.GET;
51+
import jakarta.ws.rs.Path;
52+
53+
@Path("/poem")
54+
@Authenticated
55+
public class PoemResource {
56+
57+
private final PoemAiService aiService;
58+
59+
public PoemResource(PoemAiService aiService) throws URISyntaxException {
60+
this.aiService = aiService;
61+
}
62+
63+
@GET
64+
public String getPoem() {
65+
return aiService.writeAPoem();
66+
}
67+
}
68+
69+
```
70+
71+
`PoemResource` can only be accessed by authenticated users.
72+
73+
## Google Authentication
74+
75+
This demo requires users to authenticate with Google.
76+
All you need to do is to register an application with Google, follow steps listed in the [Quarkus Google](https://quarkus.io/guides/security-openid-connect-providers#google) section.
77+
Name your Google application as `Quarkus LangChain4j AI`, and make sure an allowed callback URL is set to `http://localhost:8080/login`.
78+
Google will generate a client id and secret, use them to set `quarkus.oidc.client-id` and `quarkus.oidc.credentials.secret` properties:
79+
80+
```properties
81+
quarkus.oidc.provider=google
82+
quarkus.oidc.client-id=${GOOGLE_CLIENT_ID}
83+
quarkus.oidc.credentials.secret=${GOOGLE_CLIENT_SECRET}
84+
quarkus.oidc.authentication.extra-params.scope=https://www.googleapis.com/auth/generative-language.retriever,https://www.googleapis.com/auth/cloud-platform
85+
quarkus.oidc.authentication.redirect-path=/login
86+
87+
# See https://cloud.google.com/vertex-ai/docs/general/locations
88+
vertex-ai-region=europe-west2
89+
90+
quarkus.langchain4j.vertexai.gemini.location=https://${vertex-ai-region}-aiplatform.googleapis.com
91+
quarkus.langchain4j.vertexai.gemini.project-id=${GOOGLE_PROJECT_ID}
92+
```
93+
94+
You must enable Vertex AI API in your Google Cloud project.
95+
96+
## Security Considerations
97+
98+
This demo makes it possible to access Google Vertex AI API enabled in the Google Cloud project only to users who:
99+
100+
* Authenticated to Quarkus REST PoemService with Google using OIDC authorization code flow.
101+
* Authorized `Quarkus LangChain4j AI` application registered in the Google Cloud project to use the access token to access Google Generative API on behalf of the currently authentiicated user. This authorization is requested from users during the authentication process and is configured by adding `quarkus.oidc.authentication.extra-params.scope=https://www.googleapis.com/auth/generative-language.retriever,https://www.googleapis.com/auth/cloud-platform` in the application properties.
102+
* Quarkus LangChain4j vertex-ai-gemini model provider uses this authorized token on behalf of the current user to access Google Vertex AI endpoint.
103+
104+
## Running the Demo
105+
106+
To run the demo, use the following commands:
107+
108+
```shell
109+
mvn quarkus:dev
110+
```
111+
112+
Then, access `http://localhost:8080`, login to Google, and follow a provided application link to read the poem.
113+

‎samples/secure-vertex-ai-gemini-poem/pom.xml‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
3+
<modelVersion>4.0.0</modelVersion>
4+
5+
<groupId>io.quarkiverse.langchain4j</groupId>
6+
<artifactId>quarkus-langchain4j-sample-secure-vertex-ai-gemini-poem</artifactId>
7+
<name>Quarkus LangChain4j - Sample - Secure Vertex AI Gemini Poem</name>
8+
<version>1.0-SNAPSHOT</version>
9+
10+
<properties>
11+
<compiler-plugin.version>3.13.0</compiler-plugin.version>
12+
<maven.compiler.parameters>true</maven.compiler.parameters>
13+
<maven.compiler.release>17</maven.compiler.release>
14+
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
15+
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
16+
<quarkus.platform.artifact-id>quarkus-bom</quarkus.platform.artifact-id>
17+
<quarkus.platform.group-id>io.quarkus</quarkus.platform.group-id>
18+
<quarkus.platform.version>3.8.2</quarkus.platform.version>
19+
<skipITs>true</skipITs>
20+
<surefire-plugin.version>3.2.5</surefire-plugin.version>
21+
<quarkus-langchain4j.version>999-SNAPSHOT</quarkus-langchain4j.version>
22+
</properties>
23+
24+
<dependencyManagement>
25+
<dependencies>
26+
<dependency>
27+
<groupId>${quarkus.platform.group-id}</groupId>
28+
<artifactId>${quarkus.platform.artifact-id}</artifactId>
29+
<version>${quarkus.platform.version}</version>
30+
<type>pom</type>
31+
<scope>import</scope>
32+
</dependency>
33+
</dependencies>
34+
</dependencyManagement>
35+
36+
<dependencies>
37+
<dependency>
38+
<groupId>io.quarkus</groupId>
39+
<artifactId>quarkus-resteasy-reactive-jackson</artifactId>
40+
</dependency>
41+
<dependency>
42+
<groupId>io.quarkus</groupId>
43+
<artifactId>quarkus-oidc</artifactId>
44+
</dependency>
45+
<dependency>
46+
<groupId>io.quarkiverse.langchain4j</groupId>
47+
<artifactId>quarkus-langchain4j-vertex-ai-gemini</artifactId>
48+
<version>${quarkus-langchain4j.version}</version>
49+
</dependency>
50+
<dependency>
51+
<groupId>io.quarkus</groupId>
52+
<artifactId>quarkus-resteasy-reactive-qute</artifactId>
53+
</dependency>
54+
</dependencies>
55+
<build>
56+
<plugins>
57+
<plugin>
58+
<groupId>io.quarkus</groupId>
59+
<artifactId>quarkus-maven-plugin</artifactId>
60+
<version>${quarkus.platform.version}</version>
61+
<executions>
62+
<execution>
63+
<goals>
64+
<goal>build</goal>
65+
</goals>
66+
</execution>
67+
</executions>
68+
</plugin>
69+
<plugin>
70+
<artifactId>maven-compiler-plugin</artifactId>
71+
<version>${compiler-plugin.version}</version>
72+
</plugin>
73+
<plugin>
74+
<artifactId>maven-surefire-plugin</artifactId>
75+
<version>3.2.5</version>
76+
<configuration>
77+
<systemPropertyVariables>
78+
<java.util.logging.manager>org.jboss.logmanager.LogManager</java.util.logging.manager>
79+
<maven.home>${maven.home}</maven.home>
80+
</systemPropertyVariables>
81+
</configuration>
82+
</plugin>
83+
</plugins>
84+
</build>
85+
86+
<profiles>
87+
<profile>
88+
<id>native</id>
89+
<activation>
90+
<property>
91+
<name>native</name>
92+
</property>
93+
</activation>
94+
<build>
95+
<plugins>
96+
<plugin>
97+
<artifactId>maven-failsafe-plugin</artifactId>
98+
<version>3.2.5</version>
99+
<executions>
100+
<execution>
101+
<goals>
102+
<goal>integration-test</goal>
103+
<goal>verify</goal>
104+
</goals>
105+
<configuration>
106+
<systemPropertyVariables>
107+
<native.image.path>${project.build.directory}/${project.build.finalName}-runner</native.image.path>
108+
<java.util.logging.manager>org.jboss.logmanager.LogManager</java.util.logging.manager>
109+
<maven.home>${maven.home}</maven.home>
110+
</systemPropertyVariables>
111+
</configuration>
112+
</execution>
113+
</executions>
114+
</plugin>
115+
</plugins>
116+
</build>
117+
<properties>
118+
<quarkus.package.type>native</quarkus.package.type>
119+
</properties>
120+
</profile>
121+
</profiles>
122+
</project>

‎samples/secure-vertex-ai-gemini-poem/src/main/java/io/quarkiverse/langchain4j/sample/LoginResource.java‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
package io.quarkiverse.langchain4j.sample;
2+
3+
import org.eclipse.microprofile.jwt.JsonWebToken;
4+
5+
import io.quarkus.oidc.IdToken;
6+
import io.quarkus.qute.Template;
7+
import io.quarkus.qute.TemplateInstance;
8+
import io.quarkus.security.Authenticated;
9+
import jakarta.inject.Inject;
10+
import jakarta.ws.rs.GET;
11+
import jakarta.ws.rs.Path;
12+
import jakarta.ws.rs.Produces;
13+
14+
/**
15+
* Login resource which returns a poem welcome page to the authenticated user
16+
*/
17+
@Path("/login")
18+
@Authenticated
19+
public class LoginResource {
20+
21+
@Inject
22+
@IdToken
23+
JsonWebToken idToken;
24+
25+
@Inject
26+
Template poem;
27+
28+
@GET
29+
@Produces("text/html")
30+
public TemplateInstance poem() {
31+
return poem.data("name", idToken.getName());
32+
}
33+
}

0 commit comments

Comments
 (0)