quarkus-oidc adds OpenID Connect (OIDC) authentication to a Quarkus application. Add it with `quarkus extension add oidc`. In Dev mode, Quarkus Dev Services can then start and configure Keycloak as an OIDC provider, provided Docker or Podman is available. section 3.4.1
For a secured web application, set `quarkus.oidc.application-type=web_app` and apply the `authenticated` policy to `/*`. This requires login for every resource; a logout path can also be configured. section 6.1.2
Listing 6.3 Security-related configuration in the Users service
quarkus.http.auth.permission.all-resources.paths=/* quarkus.http.auth.permission.all-resources.policy=authenticated quarkus.oidc.application-type=web_app quarkus.oidc.logout.path=/logout
These application properties secure every path, select the OIDC web-application type, and provide `/logout`. section 6.1.2
To check an authenticated request, obtain a token through the Dev UI and send it as a Bearer token. A REST endpoint can inject `SecurityContext` and read the current principal’s name. For calls between services, token propagation uses a separate extension, `quarkus-rest-client-oidc-token-propagation`, with `@AccessToken` on the REST client interface. section 3.4.1 section 6.6
Dev Services Keycloak can be shared by applications in Dev mode, but stopping the application that started it also stops its container. If tests do not use OIDC, `%test.quarkus.oidc.enabled=false` avoids starting Keycloak for them. Keycloak is not the only supported OIDC provider. section 6.1.2 section 3.4.1 section 6.3
