Security protects application pages, services, data, and communications from unauthorized access. In a Quarkus web application, authentication can be delegated to Keycloak through OpenID Connect (OIDC), replacing anonymous requests with an identified user. section 6.1.2
Dev Services simplifies development by starting and configuring a Keycloak instance automatically. Multiple Quarkus applications in Dev mode can share one instance, allowing the Users and Reservation services to use the same identity provider. section 6.1.2
Listing 6.3 Security-related configuration in the Users service
quarkus.http.auth.permission.all-resources.paths=/* quarkus.http.auth.permission.all-resources.policy=authenticated quarkus.oidc.application-type=web_app quarkus.oidc.logout.path=/logout
Require authentication for every HTTP path, select the web application OIDC mode, and expose a logout path through Quarkus configuration. section 6.1.2
Authenticated greetings
After login through Keycloak, the WhoAmI page can display an authenticated identity such as “Hello alice!” or “Hello bob!” instead of an anonymous user. section 6.1.2
Quarkus security also supports several alternative protection and identity-management approaches:
- Connect applications to external OIDC providers, including Google and other identity platforms. section 6.3
- Retrieve credentials from relational databases through JDBC or JPA, or from LDAP. section 6.3
- Authenticate requests with JWTs issued by a separate token server. section 6.3
- Enable CORS protection with a filter and restrict requests to configured allowed origins. section 6.3
