liveBook · Manning

Authentication policy

As explained in Quarkus in Action

An authentication policy is a rule that determines whether requests to a resource collection must be associated with an authenticated identity.

An authentication policy determines whether requests to a resource collection must be associated with an authenticated identity. In Quarkus, define a collection of paths and assign it a policy; applying `authenticated` to `/*` forbids anonymous access to every exposed resource. section 6.1.2

Listing 6.3 Security-related configuration in the Users service
quarkus.http.auth.permission.all-resources.paths=/*
quarkus.http.auth.permission.all-resources.policy=authenticated
quarkus.oidc.application-type=web_app
quarkus.oidc.logout.path=/logout

Use this configuration to protect all Users service resources and enable browser-oriented OIDC login and logout. section 6.1.2

Configure the policy by:

  • Choosing the resource paths, such as `/*` for the entire application. section 6.1.2
  • Assigning `authenticated`, or using a more fine-grained policy such as a required role. section 6.1.2
  • Selecting `web_app` for browser redirects through the Authorization Code Flow; use `service` for REST resources that authenticate with an Authorization header. section 6.1.2
  • Adding a logout path to invalidate the active session. section 6.1.2

How Quarkus in Action covers it

How deep it goes
Defines path matching, authenticated access, role-based refinement, OIDC application modes, and logout, without detailing policy internals.
Examples
Uses a Users service configuration that protects `/*`, enables `web_app`, and exposes `/logout`.
What it assumes
Assumes the Quarkus OIDC extension and a Keycloak integration, while distinguishing browser and service authentication modes.
What you can do after
Operate/configure Quarkus authentication policies for browser applications and REST services.
How it connects
Connects resource paths with OIDC, Keycloak, Authorization Code Flow, sessions, roles, and HTTP Authorization headers.
Cover of Quarkus in Action
liveBookmanning.com
Read Quarkus in Action on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Quarkus in Action. The section links point to the parts of the book it draws on.