The Quarkus Security architecture provides several built-in authentication mechanisms. The HttpAuthenticationMechanism
interface is the main entry mechanism for securing HTTP applications in Quarkus. Quarkus Security is also highly customizable.
Core components of Quarkus Security
Quarkus Security uses HttpAuthenticationMechanism
to extract the authentication credentials from the HTTP request and delegates them to IdentityProvider
to convert the credentials to SecurityIdentity
.
For example, the credentials can come from the Authorization
header, client HTTPS certificates, or cookies.
IdentityProvider
verifies the authentication credentials and maps them to SecurityIdentity
, which has the username, roles, original authentication credentials, and other attributes.
You can inject a SecurityIdentity
instance for every authenticated resource to get the authenticated identity information.
In other contexts, it is possible to have other parallel representations of the same information or parts of it, for example, SecurityContext
for Jakarta REST or JsonWebToken
for JSON Web Tokens (JWT).
For more information, see Identity providers.
Supported authentication mechanisms
To learn more about security authentication in Quarkus and the supported mechanisms and protocols, see Authentication mechanisms in Quarkus.
Proactive authentication
Proactive authentication is enabled in Quarkus by default. The request is always authenticated if an incoming request has a credential, even if the target page does not require authentication For more information, see Proactive authentication.
Quarkus Security customization
Quarkus Security is also highly customizable. You can customize the following core security components of Quarkus:
-
HttpAuthenticationMechanism
-
IdentityProvider
-
SecurityidentityAugmentor
For more information about customizing Quarkus Security, including reactive security and how to register a security provider, see Security customization.