Introduction to Quarkus Security
summary
Shows Quarkus Security architecture with hands-on details: how to run Dev mode OIDC testing, generate signed/encrypted JWTs (including inner-sign+encrypt) via the SmallRye/Quarkus APIs, and customize the SecurityIdentity for role- and permission-based checks. Annotations pick the actual auth mechanism (basic, token, cookie) at runtime, token propagation passes verified access tokens to downstream services, and a simple configuration supports authenticating against many OIDC/OAuth2 providers using multi-tenant OIDC resolver. Mentions recent community milestone of ~1000 contributors.
AI-written summary · about
chapters (21)
- 0:00Welcome and introduction
- 1:09Quarkus security evolution
- 3:33Securing production applications
- 7:12Authentication mechanisms overview
- 13:16Security manager architecture
- 16:10Customizing security identity
- 17:37Authorization policies
- 19:11Understanding JWT tokens
- 22:10OpenID Connect basics
- 24:08OIDC authentication flow
- 27:50OpenID Connect capabilities
- 30:00Token propagation support
- 33:06Access token scopes
- 34:38Token audience validation
- 36:32Logout and redirection
- 37:46Social provider integration
- 38:56Configuring multiple providers
- 40:13Provider configuration resolver
- 44:06Provider-specific permissions
- 47:04User info from providers
- 50:19Summary and closing
related talks
35mQuarkus Security for Spring developers
33mSecuring Your Quarkus Applications
31mSecure your Quarkus Applications
46mOAuth for Java Developers
21mReconciling Zero-Trust APIs and Developer eXperience
46mSecure your Microservices with ZeroTrust approach
37mIntroduction to Verifiable Credentials
25mFine-Grained Authorization & Beyond: Mastering Keycloak Patterns in AI-infused Apps