Secure your Quarkus Applications
summary
Live coding shows a Quarkus REST app locked down with quarkus-oidc against a running Keycloak identity provider, using @RolesAllowed and configuration policies to require the user role and return 401s for unauthenticated calls. Code injects SecurityIdentity and JsonWebToken to read principal, roles and custom claims. Demo builds a frontend that obtains tokens, hits the service, fixes a CORS hiccup with quarkus.http.cors=true, and forwards the Authorization header between services using the MicroProfile Rest Client propagate-headers feature — token propagation works end-to-end.
AI-written summary · about
chapters (8)
- 0:00Introduction to Quarkus
- 2:06Security architecture options
- 5:11Demo setup and prerequisites
- 8:47Project initialization
- 12:05Implementing basic security
- 18:07Accessing security identities
- 23:43Configuration-based security
- 26:35Service token propagation
related talks
33mSecuring Your Quarkus Applications
35mQuarkus Security for Spring developers
52mIntroduction to Quarkus Security
25mFine-Grained Authorization & Beyond: Mastering Keycloak Patterns in AI-infused Apps
46mSecure your Microservices with ZeroTrust approach
21mReconciling Zero-Trust APIs and Developer eXperience
48mIntegration Testing with Quarkus.
46mOAuth for Java Developers