OpenID Connect (OIDC) adds an identity layer to OAuth 2.0, letting applications verify users and obtain authentication claims. In Quarkus, the quarkus-oidc extension connects an application to an OIDC provider such as Keycloak. section 3.4.1
A practical Quarkus development workflow is:
- Add the quarkus-oidc extension. section 3.4.1
- Run Dev mode with Docker or Podman available so Dev Services can start Keycloak in a container. section 3.4.1
- Use the Dev UI to obtain a token, send it as a Bearer token, and inspect the authenticated request. section 3.4.1
- Inject SecurityContext and read the current Principal to identify the logged-in user. section 3.4.1
Inspecting the current user
A REST endpoint can return the authenticated principal’s name and fall back to "anonymous" when no principal is available. A request can carry the token with an Authorization: Bearer header. section 3.4.1
$ quarkus extension add oidc
Use the extension command as the shortest path to enable OIDC in a Quarkus application. section 3.4.1
Dev Services supplies sensible Keycloak defaults and can share an instance across Quarkus applications in Dev mode. Disable OIDC during tests when tests do not use Keycloak, avoiding unnecessary container startup. Production integrations can use providers such as Google, Apple, Facebook, or other supported OIDC services. section 3.4.1 section 6.3
