Quarkus comes with build in security to allow for RBAC based on the common security annotations @RolesAllowed,
@DenyAll, @PermitAll on REST endpoints. An example of an endpoint that makes use of both JAX-RS and Common
Security annotations to describe and secure its endpoints is given in SubjectExposingResource Example. Quarkus also provides
the io.quarkus.security.Authenticated annotation that will permit any authenticated user to access the resource
(equivalent to @RolesAllowed("*")).
import java.security.Principal;
import javax.annotation.security.DenyAll;
import javax.annotation.security.PermitAll;
import javax.annotation.security.RolesAllowed;
import javax.ws.rs.GET;
import javax.ws.rs.Path;
import javax.ws.rs.core.Context;
import javax.ws.rs.core.SecurityContext;
@Path("subject")
public class SubjectExposingResource {
@GET
@Path("secured")
@RolesAllowed("Tester") (1)
public String getSubjectSecured(@Context SecurityContext sec) {
Principal user = sec.getUserPrincipal(); (2)
String name = user != null ? user.getName() : "anonymous";
return name;
}
@GET
@Path("unsecured")
@PermitAll(3)
public String getSubjectUnsecured(@Context SecurityContext sec) {
Principal user = sec.getUserPrincipal(); (4)
String name = user != null ? user.getName() : "anonymous";
return name;
}
@GET
@Path("denied")
@DenyAll(5)
public String getSubjectDenied(@Context SecurityContext sec) {
Principal user = sec.getUserPrincipal();
String name = user != null ? user.getName() : "anonymous";
return name;
}
}
| 1 | This /subject/secured endpoint requires an authenticated user that has been granted the role "Tester" through the use of the @RolesAllowed("Tester") annotation. |
| 2 | The endpoint obtains the user principal from the JAX-RS SecurityContext. This will be non-null for a secured endpoint. |
| 3 | The /subject/unsecured endpoint allows for unauthenticated access by specifying the @PermitAll annotation. |
| 4 | This call to obtain the user principal will return null if the caller is unauthenticated, non-null if the caller is authenticated. |
| 5 | The /subject/denied endpoint disallows any access regardless of whether the call is authenticated by specifying the @DenyAll annotation. |
Security implementations
Quarkus comes with several different Security extensions that provide different functionality. This functionality is very much a work in progress, so this list will be expanded over the coming weeks.
| Extension | Description |
|---|---|
Provides support for simples properties files that can be used for testing security. This supports both embedding user info in |
|
Provides support for OAuth2 flows using Elytron. This extension will likely be deprecated soon and replaced by a reactive Vert.x version. |
|
A Microprofile JWT implementation that provides support for authenticating using Json Web Tokens. This also allows you to inject the token and claims into the application as per the MP JWT spec. |
|
Provides support for authenticating via an OpenID Connect provider such as Keycloak. |
Please see the linked documents above for details on how to setup the various extensions.
Registering Security Providers
When running in native mode the default behavior for Graal native image generation is to only include the main "SUN" provider
unless you have enabled SSL, in which case all security providers are registered. If you are not using SSL, then you can selectively
register security providers by name using the quarkus.security.users.security-providers property. The following example illustrates
configuration to register the "SunRsaSign" and "SunJCE" security providers:
quarkus.security.security-providers=SunRsaSign,SunJCE
...