You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: _versions/main/guides/security-jwt.adoc
+58-45Lines changed: 58 additions & 45 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -145,9 +145,9 @@ public class TokenSecuredResource {
145
145
<7> Builds a response containing the caller's name, the `isSecure()` and `getAuthenticationScheme()` states of the request `SecurityContext`, and whether a non-null `JsonWebToken` was injected.
146
146
147
147
[[run-application]]
148
-
=== Run the application
148
+
=== Run the application in dev mode
149
149
150
-
Now, you are ready to run the application by using one of the following commands:
150
+
Now, you are ready to run the application in dev mode by using one of the following commands:
151
151
152
152
include::{includes}/devtools/dev.adoc[]
153
153
@@ -174,6 +174,12 @@ Now that the REST endpoint is running, you can access it by using a command line
The JWT string is a Base64 URL-encoded string consisting of three parts, separated by `.` characters:
@@ -459,15 +469,19 @@ The JWT string is a Base64 URL-encoded string consisting of three parts, separat
459
469
Now, let's use this to make a secured request to the `/secured/roles-allowed` endpoint.
460
470
Make sure you have the Quarkus server still running in dev mode, and then run the following command, making sure to use your version of the generated JWT from the previous step:
Copy file name to clipboardExpand all lines: _versions/main/guides/security-oidc-bearer-token-authentication-tutorial.adoc
+10-1Lines changed: 10 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -231,7 +231,16 @@ For more information, see the Keycloak documentation about link:https://www.keyc
231
231
ifndef::no-quarkus-keycloak-admin-client[]
232
232
[NOTE]
233
233
====
234
-
If you want to use the Keycloak Admin Client to configure your server from your application, you need to include either the `quarkus-keycloak-admin-rest-client` or the `quarkus-keycloak-admin-resteasy-client` (if the application uses `quarkus-rest-client`) extension.
234
+
To configure the Keycloak server from your application by using the Keycloak Admin Client, include one of the following extensions based on your setup:
235
+
236
+
- *For Quarkus REST*: If you are using `quarkus-rest`, `quarkus-rest-client`, or both, include the `quarkus-keycloak-admin-rest-client` extension.
237
+
238
+
- *For RESTEasy Classic*: If you are using `quarkus-resteasy`, `quarkus-resteasy-client`, or both, include the `quarkus-keycloak-admin-resteasy-client` extension.
239
+
240
+
- *If no REST layer is explicitly used*: It is recommended to include the `quarkus-keycloak-admin-rest-client` extension.
241
+
242
+
These guidelines ensure seamless integration of the Keycloak Admin Client with your REST framework, whether you are working with a REST server, a REST client, or both.
243
+
235
244
For more information, see the xref:security-keycloak-admin-client.adoc[Quarkus Keycloak Admin Client] guide.
Copy file name to clipboardExpand all lines: _versions/main/guides/security-oidc-code-flow-authentication.adoc
+9-1Lines changed: 9 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -50,6 +50,14 @@ For information about how to support multiple tenants, see xref:security-openid-
50
50
51
51
== Using the authorization code flow mechanism
52
52
53
+
=== Configuring Quarkus to support authorization code flow
54
+
55
+
To enable an authorization code flow authentication, the `quarkus.oidc.application-type` property must be set to `web-app`.
56
+
Usually, the Quarkus OIDC `web-app` application type must be set when your Quarkus application is a frontend application which serves HTML pages and requires an OIDC single sign-on login.
57
+
For the Quarkus OIDC `web-app` application, the authorization code flow is defined as the preferred method for authenticating users.
58
+
When your application serves HTML pages and provides REST API at the same time, and requires both the authorization code flow authentication and xref:security-oidc-bearer-token-authentication.adoc[the bearer access token authentication], the `quarkus.oidc.application-type` property can be set to `hybrid` instead.
59
+
In this case, the authorization code flow is only triggered when an HTTP `Authorization` request header with a `Bearer` authorization scheme containing a bearer access token is not set.
60
+
53
61
=== Configuring access to the OIDC provider endpoint
54
62
55
63
The OIDC `web-app` application requires URLs of the OIDC provider's authorization, token, `JsonWebKey` (JWK) set, and possibly the `UserInfo`, introspection and end-session (RP-initiated logout) endpoints.
@@ -789,7 +797,7 @@ It applies to ID tokens and also to access tokens in a JWT format, if the `web-a
789
797
[[jose4j-validator]]
790
798
==== Jose4j Validator
791
799
792
-
You can register a custom [Jose4j Validator] to customize the JWT claim verification process. See xref:security-oidc-bearer-token-authentication.adoc#jose4j-validator[Jose4j] section for more information.
800
+
You can register a custom Jose4j Validator to customize the JWT claim verification process. See the xref:security-oidc-bearer-token-authentication.adoc#jose4j-validator[Jose4j] section for more information.
0 commit comments