versión:

OpenID Connect (OIDC) and OAuth2 client and filters

You can use Quarkus extensions for OpenID Connect and OAuth 2.0 access token management, focusing on acquiring, refreshing, and propagating tokens.

This includes the following:

Using quarkus-oidc-client, quarkus-rest-client-oidc-filter and quarkus-resteasy-client-oidc-filter extensions to acquire and refresh access tokens from OpenID Connect and OAuth 2.0 compliant Authorization Servers such as Keycloak.
Using quarkus-rest-client-oidc-token-propagation and quarkus-resteasy-client-oidc-token-propagation extensions to propagate the current Bearer or Authorization Code Flow access tokens.

The access tokens managed by these extensions can be used as HTTP Authorization Bearer tokens to access the remote services.

Also see OpenID Connect client and token propagation quickstart.

OidcClient

Add the following dependency:

<dependency>
    <groupId>io.quarkus</groupId>
    <artifactId>quarkus-oidc-client</artifactId>
</dependency>

The quarkus-oidc-client extension provides a reactive io.quarkus.oidc.client.OidcClient, which can be used to acquire and refresh tokens using SmallRye Mutiny Uni and Vert.x WebClient.

OidcClient is initialized at build time with the IDP token endpoint URL, which can be auto-discovered or manually configured. OidcClient uses this endpoint to acquire access tokens by using token grants such as client_credentials or password and refresh the tokens by using a refresh_token grant.

Token endpoint configuration

By default, the token endpoint address is discovered by adding a /.well-known/openid-configuration path to the configured quarkus.oidc-client.auth-server-url.

For example, given this Keycloak URL:

quarkus.oidc-client.auth-server-url=http://localhost:8180/auth/realms/quarkus

OidcClient will discover that the token endpoint URL is http://localhost:8180/auth/realms/quarkus/protocol/openid-connect/tokens.

Alternatively, if the discovery endpoint is unavailable or you want to save on the discovery endpoint round-trip, you can disable the discovery and configure the token endpoint address with a relative path value. For example:

quarkus.oidc-client.auth-server-url=http://localhost:8180/auth/realms/quarkus
quarkus.oidc-client.discovery-enabled=false
# Token endpoint: http://localhost:8180/auth/realms/quarkus/protocol/openid-connect/tokens
quarkus.oidc-client.token-path=/protocol/openid-connect/tokens

A more compact way to configure the token endpoint URL without the discovery is to set quarkus.oidc-client.token-path to an absolute URL:

quarkus.oidc-client.token-path=http://localhost:8180/auth/realms/quarkus/protocol/openid-connect/tokens

Setting quarkus.oidc-client.auth-server-url and quarkus.oidc-client.discovery-enabled is not required in this case.

Supported token grants

The main token grants that OidcClient can use to acquire the tokens are the client_credentials (default) and password grants.

Client credentials grant

Here is how OidcClient can be configured to use the client_credentials grant:

quarkus.oidc-client.auth-server-url=http://localhost:8180/auth/realms/quarkus/
quarkus.oidc-client.client-id=quarkus-app
quarkus.oidc-client.credentials.secret=secret

The client_credentials grant allows setting extra parameters for the token request by using quarkus.oidc-client.grant-options.client.<param-name>=<value>. Here is how to set the intended token recipient by using the audience parameter:

quarkus.oidc-client.auth-server-url=http://localhost:8180/auth/realms/quarkus/
quarkus.oidc-client.client-id=quarkus-app
quarkus.oidc-client.credentials.secret=secret
# 'client' is a shortcut for `client_credentials`
quarkus.oidc-client.grant.type=client
quarkus.oidc-client.grant-options.client.audience=https://example.com/api

Password grant

Here is how OidcClient can be configured to use the password grant:

quarkus.oidc-client.auth-server-url=http://localhost:8180/auth/realms/quarkus/
quarkus.oidc-client.client-id=quarkus-app
quarkus.oidc-client.credentials.secret=secret
quarkus.oidc-client.grant.type=password
quarkus.oidc-client.grant-options.password.username=alice
quarkus.oidc-client.grant-options.password.password=alice

It can be further customized by using a quarkus.oidc-client.grant-options.password configuration prefix, similar to how the client credentials grant can be customized.

Other grants

OidcClient can also help acquire the tokens by using grants that require some extra input parameters that cannot be captured in the configuration. These grants are refresh_token (with the external refresh token), authorization_code, and two grants which can be used to exchange the current access token, namely, urn:ietf:params:oauth:grant-type:token-exchange and urn:ietf:params:oauth:grant-type:jwt-bearer.

If you need to acquire an access token and have posted an existing refresh token to the current Quarkus endpoint, you must use the refresh_token grant. This grant employs an out-of-band refresh token to obtain a new token set. In this case, configure OidcClient as follows:

quarkus.oidc-client.auth-server-url=http://localhost:8180/auth/realms/quarkus/
quarkus.oidc-client.client-id=quarkus-app
quarkus.oidc-client.credentials.secret=secret
quarkus.oidc-client.grant.type=refresh

Then you can use the OidcClient.refreshTokens method with a provided refresh token to get the access token.

Using the urn:ietf:params:oauth:grant-type:token-exchange or urn:ietf:params:oauth:grant-type:jwt-bearer grants might be required if you are building a complex microservices application and want to avoid the same Bearer token be propagated to and used by more than one service. See Token Propagation in MicroProfile RestClient Reactive filter and Token Propagation in MicroProfile RestClient filter for more details.

Using OidcClient to support the authorization code grant might be required if, for some reason, you cannot use the Quarkus OIDC extension to support Authorization Code Flow. If there is a very good reason for you to implement Authorization Code Flow, then you can configure OidcClient as follows:

quarkus.oidc-client.auth-server-url=http://localhost:8180/auth/realms/quarkus/
quarkus.oidc-client.client-id=quarkus-app
quarkus.oidc-client.credentials.secret=secret
quarkus.oidc-client.grant.type=code

Then, you can use the OidcClient.accessTokens method to accept a Map of extra properties and pass the current code and redirect_uri parameters to exchange the authorization code for the tokens.

OidcClient also supports the urn:openid:params:grant-type:ciba grant:

quarkus.oidc-client.auth-server-url=http://localhost:8180/auth/realms/quarkus/
quarkus.oidc-client.client-id=quarkus-app
quarkus.oidc-client.credentials.secret=secret
quarkus.oidc-client.grant.type=ciba

Then, you can use the OidcClient.accessTokens method to accept a Map of extra properties and pass the auth_req_id parameter to exchange the token authorization code.

Grant scopes

You might need to request that a specific set of scopes be associated with an issued access token. Use a dedicated quarkus.oidc-client.scopes list property, for example: quarkus.oidc-client.scopes=email,phone

Use OidcClient directly

You can use OidcClient directly to acquire access tokens and set them in an HTTP Authorization header as a Bearer scheme value.

For example, let’s assume the Quarkus endpoint has to access a microservice that returns a user name. First, create a REST client:

package org.acme.security.openid.connect.client;

import org.eclipse.microprofile.rest.client.inject.RegisterRestClient;

import io.smallrye.mutiny.Uni;
import jakarta.ws.rs.GET;
import jakarta.ws.rs.HeaderParam;
import jakarta.ws.rs.Path;
import jakarta.ws.rs.Produces;

@RegisterRestClient
@Path("/")
public interface RestClientWithTokenHeaderParam {

    @GET
    @Produces("text/plain")
    @Path("userName")
    Uni<String> getUserName(@HeaderParam("Authorization") String authorization);
}

Now, use OidcClient to acquire the tokens and propagate them:

package org.acme.security.openid.connect.client;

import org.eclipse.microprofile.rest.client.inject.RestClient;

import io.quarkus.oidc.client.runtime.TokensHelper;
import io.quarkus.oidc.client.OidcClient;

import io.smallrye.mutiny.Uni;
import jakarta.inject.Inject;
import jakarta.ws.rs.GET;
import jakarta.ws.rs.Path;
import jakarta.ws.rs.Produces;

@Path("/service")
public class OidcClientResource {

    @Inject
    OidcClient client;
    TokensHelper tokenHelper = new TokensHelper(); (1)

    @Inject
    @RestClient
    RestClientWithTokenHeaderParam restClient;

    @GET
    @Path("user-name")
    @Produces("text/plain")
    public Uni<String> getUserName() {
    	return tokenHelper.getTokens(client).onItem()
        		.transformToUni(tokens -> restClient.getUserName("Bearer " + tokens.getAccessToken()));
    }
}

1	`io.quarkus.oidc.client.runtime.TokensHelper` manages the access token acquisition and refresh.

Inject tokens

You can inject Tokens that use OidcClient internally. Tokens can be used to acquire the access tokens and refresh them if necessary:

import jakarta.inject.PostConstruct;
import jakarta.inject.Inject;
import jakarta.ws.rs.GET;

import io.quarkus.oidc.client.Tokens;

@Path("/service")
public class OidcClientResource {

    @Inject Tokens tokens;

    @GET
    public String getResponse() {
        //  Get the access token, which might have been refreshed.
        String accessToken = tokens.getAccessToken();
        // Use the access token to configure MP RestClient Authorization header/etc
    }
}

Use OidcClients

io.quarkus.oidc.client.OidcClients is a container of OidcClients - it includes a default OidcClient and named clients which can be configured like this:

quarkus.oidc-client.client-enabled=false

quarkus.oidc-client.jwt-secret.auth-server-url=http://localhost:8180/auth/realms/quarkus/
quarkus.oidc-client.jwt-secret.client-id=quarkus-app
quarkus.oidc-client.jwt-secret.credentials.jwt.secret=AyM1SysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS0gZH75aKtMN3Yj0iPS4hcgUuTwjAzZr1Z9CAow

In this case, the default client is disabled with a client-enabled=false property. The jwt-secret client can be accessed like this:

import org.eclipse.microprofile.rest.client.inject.RestClient;

import jakarta.inject.Inject;
import jakarta.ws.rs.GET;
import jakarta.ws.rs.Path;
import io.smallrye.mutiny.Uni;
import io.quarkus.oidc.client.OidcClient;
import io.quarkus.oidc.client.OidcClients;
import io.quarkus.oidc.client.runtime.TokensHelper;

@Path("/clients")
public class OidcClientResource {

    @Inject
    OidcClients clients;
    TokensHelper tokenHelper = new TokensHelper();

    @Inject
    @RestClient
    RestClientWithTokenHeaderParam restClient; (1)

    @GET
    @Path("user-name")
    @Produces("text/plain")
    public Uni<String> getUserName() {
    	OidcClient client = clients.getClient("jwt-secret");
    	return tokenHelper.getTokens(client).onItem()
        		.transformToUni(tokens -> restClient.getUserName("Bearer " + tokens.getAccessToken()));
    }
}

1	See the `RestClientWithTokenHeaderParam` declaration in the Use OidcClient directly section.

If you also use OIDC multitenancy, and each OIDC tenant has its own associated OidcClient, you can use a Vert.x RoutingContext tenant-id attribute. For example:

import jakarta.inject.Inject;
import jakarta.ws.rs.GET;
import jakarta.ws.rs.Path;

import io.quarkus.oidc.client.OidcClient;
import io.quarkus.oidc.client.OidcClients;
import io.vertx.ext.web.RoutingContext;

@Path("/clients")
public class OidcClientResource {

    @Inject
    OidcClients clients;
    @Inject
    RoutingContext context;

    @GET
    public String getResponse() {
        String tenantId = context.get("tenant-id");
        // named OIDC tenant and client configurations use the same key:
        OidcClient client = clients.getClient(tenantId);
        //Use this client to get the token
    }
}

You can also create a new OidcClient programmatically. For example, let’s assume you must create it at startup time:

package org.acme.security.openid.connect.client;

import java.util.Map;

import org.eclipse.microprofile.config.inject.ConfigProperty;

import io.quarkus.oidc.client.OidcClient;
import io.quarkus.oidc.client.OidcClientConfig;
import io.quarkus.oidc.client.OidcClientConfig.Grant.Type;
import io.quarkus.oidc.client.OidcClients;
import io.quarkus.runtime.StartupEvent;
import io.smallrye.mutiny.Uni;
import jakarta.enterprise.context.ApplicationScoped;
import jakarta.enterprise.event.Observes;
import jakarta.i
nject.Inject;

@ApplicationScoped
public class OidcClientCreator {

    @Inject
    OidcClients oidcClients;
    @ConfigProperty(name = "quarkus.oidc.auth-server-url")
    String oidcProviderAddress;

    private volatile OidcClient oidcClient;

    public void startup(@Observes StartupEvent event) {
    	createOidcClient().subscribe().with(client -> {oidcClient = client;});
    }

    public OidcClient getOidcClient() {
        return oidcClient;
    }

    private Uni<OidcClient> createOidcClient() {
        OidcClientConfig cfg = new OidcClientConfig();
        cfg.setId("myclient");
        cfg.setAuthServerUrl(oidcProviderAddress);
        cfg.setClientId("backend-service");
        cfg.getCredentials().setSecret("secret");
        cfg.getGrant().setType(Type.PASSWORD);
        cfg.setGrantOptions(Map.of("password",
        		Map.of("username", "alice", "password", "alice")));
        return oidcClients.newClient(cfg);
    }
}

Now, you can use this client like this:

import org.eclipse.microprofile.rest.client.inject.RestClient;

import jakarta.inject.Inject;
import jakarta.ws.rs.GET;
import jakarta.ws.rs.Path;
import io.smallrye.mutiny.Uni;
import io.quarkus.oidc.client.runtime.TokensHelper;

@Path("/clients")
public class OidcClientResource {

    @Inject
    OidcClientCreator oidcClientCreator;
    TokensHelper tokenHelper = new TokensHelper();

    @Inject
    @RestClient
    RestClientWithTokenHeaderParam restClient; (1)

    @GET
    @Path("user-name")
    @Produces("text/plain")
    public Uni<String> getUserName() {
    	return tokenHelper.getTokens(oidcClientCreator.getOidcClient()).onItem()
        		.transformToUni(tokens -> restClient.getUserName("Bearer " + tokens.getAccessToken()));
    }
}

1	See the `RestClientWithTokenHeaderParam` declaration in the Use OidcClient directly section.

Inject named OidcClient and tokens

In case of multiple configured OidcClient objects, you can specify the OidcClient injection target by the extra qualifier @NamedOidcClient instead of working with OidcClients:

package org.acme.security.openid.connect.client;

import org.eclipse.microprofile.rest.client.inject.RestClient;
import jakarta.inject.Inject;
import jakarta.ws.rs.GET;
import jakarta.ws.rs.Path;
import io.smallrye.mutiny.Uni;
import io.quarkus.oidc.client.runtime.TokensHelper;

@Path("/clients")
public class OidcClientResource {

    @Inject
    @NamedOidcClient("jwt-secret")
    OidcClient client;

    TokensHelper tokenHelper = new TokensHelper();

    @Inject
    @RestClient
    RestClientWithTokenHeaderParam restClient; (1)

    @GET
    @Path("user-name")
    @Produces("text/plain")
    public Uni<String> getUserName() {
    	return tokenHelper.getTokens(client).onItem()
        		.transformToUni(tokens -> restClient.getUserName("Bearer " + tokens.getAccessToken()));
    }
}

1	See the `RestClientWithTokenHeaderParam` declaration in the Use OidcClient directly section.

The same qualifier can be used to specify the OidcClient used for a Tokens injection:

@Provider
@Priority(Priorities.AUTHENTICATION)
@RequestScoped
public class OidcClientRequestCustomFilter implements ClientRequestFilter {

    @Inject
    @NamedOidcClient("jwt-secret")
    Tokens tokens;

    @Override
    public void filter(ClientRequestContext requestContext) throws IOException {
        requestContext.getHeaders().add(HttpHeaders.AUTHORIZATION, "Bearer " + tokens.getAccessToken());
    }
}

Use OidcClient in RestClient Reactive ClientFilter

Add the following Maven Dependency:

<dependency>
    <groupId>io.quarkus</groupId>
    <artifactId>quarkus-rest-client-oidc-filter</artifactId>
</dependency>

Note it will also bring io.quarkus:quarkus-oidc-client.

quarkus-rest-client-oidc-filter extension provides io.quarkus.oidc.client.filter.OidcClientRequestReactiveFilter.

It works similarly to the way OidcClientRequestFilter does (see Use OidcClient in MicroProfile RestClient client filter) - it uses OidcClient to acquire the access token, refresh it if needed, and set it as an HTTP Authorization Bearer scheme value. The difference is that it works with Reactive RestClient and implements a non-blocking client filter that does not block the current IO thread when acquiring or refreshing the tokens.

OidcClientRequestReactiveFilter delays an initial token acquisition until it is executed to avoid blocking an IO thread.

You can selectively register OidcClientRequestReactiveFilter by using either io.quarkus.oidc.client.reactive.filter.OidcClientFilter or org.eclipse.microprofile.rest.client.annotation.RegisterProvider annotations:

import org.eclipse.microprofile.rest.client.annotation.RegisterProvider;
import org.eclipse.microprofile.rest.client.inject.RegisterRestClient;
import io.quarkus.oidc.client.filter.OidcClientFilter;
import io.smallrye.mutiny.Uni;

@RegisterRestClient
@OidcClientFilter
@Path("/")
public interface ProtectedResourceService {

    @GET
    Uni<String> getUserName();
}

import org.eclipse.microprofile.rest.client.annotation.RegisterProvider;
import org.eclipse.microprofile.rest.client.inject.RegisterRestClient;
import io.quarkus.oidc.client.reactive.filter.OidcClientRequestReactiveFilter;
import io.smallrye.mutiny.Uni;

@RegisterRestClient
@RegisterProvider(OidcClientRequestReactiveFilter.class)
@Path("/")
public interface ProtectedResourceService {

    @GET
    Uni<String> getUserName();
}

OidcClientRequestReactiveFilter uses a default OidcClient by default. A named OidcClient can be selected with a quarkus.rest-client-oidc-filter.client-name configuration property. You can also select OidcClient by setting the value attribute of the @OidcClientFilter annotation. The client name set through annotation has higher priority than the quarkus.rest-client-oidc-filter.client-name configuration property. For example, given this jwt-secret named OIDC client declaration, you can refer to this client like this:

import org.eclipse.microprofile.rest.client.annotation.RegisterProvider;
import org.eclipse.microprofile.rest.client.inject.RegisterRestClient;
import io.quarkus.oidc.client.filter.OidcClientFilter;
import io.smallrye.mutiny.Uni;

@RegisterRestClient
@OidcClientFilter("jwt-secret")
@Path("/")
public interface ProtectedResourceService {

    @GET
    Uni<String> getUserName();
}

Use OidcClient in RestClient ClientFilter

Add the following Maven Dependency:

<dependency>
    <groupId>io.quarkus</groupId>
    <artifactId>quarkus-resteasy-client-oidc-filter</artifactId>
</dependency>

Note it will also bring io.quarkus:quarkus-oidc-client.

quarkus-resteasy-client-oidc-filter extension provides io.quarkus.oidc.client.filter.OidcClientRequestFilter Jakarta REST ClientRequestFilter which uses OidcClient to acquire the access token, refresh it if needed, and set it as an HTTP Authorization Bearer scheme value.

By default, this filter will get OidcClient to acquire the first pair of access and refresh tokens at its initialization time. If the access tokens are short-lived and refresh tokens are unavailable, then the token acquisition should be delayed with quarkus.oidc-client.early-tokens-acquisition=false.

You can selectively register OidcClientRequestFilter by using either io.quarkus.oidc.client.filter.OidcClientFilter or org.eclipse.microprofile.rest.client.annotation.RegisterProvider annotations:

import org.eclipse.microprofile.rest.client.inject.RegisterRestClient;
import io.quarkus.oidc.client.filter.OidcClientFilter;

@RegisterRestClient
@OidcClientFilter
@Path("/")
public interface ProtectedResourceService {

    @GET
    String getUserName();
}

import org.eclipse.microprofile.rest.client.annotation.RegisterProvider;
import org.eclipse.microprofile.rest.client.inject.RegisterRestClient;
import io.quarkus.oidc.client.filter.OidcClientRequestFilter;

@RegisterRestClient
@RegisterProvider(OidcClientRequestFilter.class)
@Path("/")
public interface ProtectedResourceService {

    @GET
    String getUserName();
}

Alternatively, OidcClientRequestFilter can be registered automatically with all MP Rest or Jakarta REST clients if the quarkus.resteasy-client-oidc-filter.register-filter=true property is set.

OidcClientRequestFilter uses a default OidcClient by default. A named OidcClient can be selected with a quarkus.resteasy-client-oidc-filter.client-name configuration property. You can also select OidcClient by setting the value attribute of the @OidcClientFilter annotation. The client name set through annotation has higher priority than the quarkus.resteasy-client-oidc-filter.client-name configuration property. For example, given this jwt-secret named OIDC client declaration, you can refer to this client like this:

import org.eclipse.microprofile.rest.client.inject.RegisterRestClient;
import io.quarkus.oidc.client.filter.OidcClientFilter;

@RegisterRestClient
@OidcClientFilter("jwt-secret")
@Path("/")
public interface ProtectedResourceService {

    @GET
    String getUserName();
}

Use a custom RestClient ClientFilter

If you prefer, you can use your own custom filter and inject Tokens:

import io.quarkus.oidc.client.Tokens;

@Provider
@Priority(Priorities.AUTHENTICATION)
public class OidcClientRequestCustomFilter implements ClientRequestFilter {

    @Inject
    Tokens tokens;

    @Override
    public void filter(ClientRequestContext requestContext) throws IOException {
        requestContext.getHeaders().add(HttpHeaders.AUTHORIZATION, "Bearer " + tokens.getAccessToken());
    }
}

The Tokens producer will acquire and refresh the tokens, and the custom filter will decide how and when to use the token.

You can also inject named Tokens, see Inject named OidcClient and Tokens

Refreshing access tokens

OidcClientRequestReactiveFilter, OidcClientRequestFilter and Tokens producers will refresh the current expired access token if the refresh token is available. Additionally, the quarkus.oidc-client.refresh-token-time-skew property can be used for a preemptive access token refreshment to avoid sending nearly expired access tokens that might cause HTTP 401 errors. For example, if this property is set to 3S and the access token will expire in less than 3 seconds, then this token will be auto-refreshed.

If the access token needs to be refreshed, but no refresh token is available, then an attempt is made to acquire a new token by using a configured grant, such as client_credentials.

Some OpenID Connect Providers will not return a refresh token in a client_credentials grant response. For example, starting from Keycloak 12, a refresh token will not be returned by default for client_credentials. The providers might also restrict the number of times a refresh token can be used.

Revoking access tokens

If your OpenId Connect provider, such as Keycloak, supports a token revocation endpoint, then OidcClient#revokeAccessToken can be used to revoke the current access token. The revocation endpoint URL will be discovered alongside the token request URI or can be configured with quarkus.oidc-client.revoke-path.

You might want to have the access token revoked if using this token with a REST client fails with an HTTP 401 status code or if the access token has already been used for a long time and you would like to refresh it.

This can be achieved by requesting a token refresh by using a refresh token. However, if the refresh token is unavailable, you can refresh it by revoking it first and then requesting a new access token.

OidcClient authentication

OidcClient has to authenticate to the OpenID Connect Provider for the client_credentials and other grant requests to succeed. All the OIDC Client Authentication options are supported, for example:

client_secret_basic:

quarkus.oidc-client.auth-server-url=http://localhost:8180/auth/realms/quarkus/
quarkus.oidc-client.client-id=quarkus-app
quarkus.oidc-client.credentials.secret=mysecret

quarkus.oidc-client.auth-server-url=http://localhost:8180/auth/realms/quarkus/
quarkus.oidc-client.client-id=quarkus-app
quarkus.oidc-client.credentials.client-secret.value=mysecret

Or with the secret retrieved from a CredentialsProvider:

quarkus.oidc-client.auth-server-url=http://localhost:8180/auth/realms/quarkus/
quarkus.oidc-client.client-id=quarkus-app

# This key is used to retrieve a secret from the map of credentials returned from CredentialsProvider
quarkus.oidc-client.credentials.client-secret.provider.key=mysecret-key
# Set it only if more than one CredentialsProvider can be registered
quarkus.oidc-client.credentials.client-secret.provider.name=oidc-credentials-provider

client_secret_post:

quarkus.oidc-client.auth-server-url=http://localhost:8180/auth/realms/quarkus/
quarkus.oidc-client.client-id=quarkus-app
quarkus.oidc-client.credentials.client-secret.value=mysecret
quarkus.oidc-client.credentials.client-secret.method=post

client_secret_jwt, signature algorithm is HS256:

quarkus.oidc-client.auth-server-url=http://localhost:8180/auth/realms/quarkus/
quarkus.oidc-client.client-id=quarkus-app
quarkus.oidc-client.credentials.jwt.secret=AyM1SysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS0gZH75aKtMN3Yj0iPS4hcgUuTwjAzZr1Z9CAow

Or with the secret retrieved from a CredentialsProvider, signature algorithm is HS256:

quarkus.oidc-client.auth-server-url=http://localhost:8180/auth/realms/quarkus/
quarkus.oidc-client.client-id=quarkus-app

# This is a key that will be used to retrieve a secret from the map of credentials returned from CredentialsProvider
quarkus.oidc-client.credentials.jwt.secret-provider.key=mysecret-key
# Set it only if more than one CredentialsProvider can be registered
quarkus.oidc-client.credentials.jwt.secret-provider.name=oidc-credentials-provider

private_key_jwt with the PEM key file, signature algorithm is RS256:

quarkus.oidc-client.auth-server-url=http://localhost:8180/auth/realms/quarkus/
quarkus.oidc-client.client-id=quarkus-app
quarkus.oidc-client.credentials.jwt.key-file=privateKey.pem

private_key_jwt with the keystore file, signature algorithm is RS256:

quarkus.oidc-client.auth-server-url=http://localhost:8180/auth/realms/quarkus/
quarkus.oidc-client.client-id=quarkus-app
quarkus.oidc-client.credentials.jwt.key-store-file=keystore.jks
quarkus.oidc-client.credentials.jwt.key-store-password=mypassword
quarkus.oidc-client.credentials.jwt.key-password=mykeypassword

# Private key alias inside the keystore
quarkus.oidc-client.credentials.jwt.key-id=mykeyAlias

Using client_secret_jwt or private_key_jwt authentication methods ensures that no client secret goes over the wire.

Additional JWT authentication options

If either client_secret_jwt or private_key_jwt authentication methods are used, then the JWT signature algorithm, key identifier, audience, subject, and issuer can be customized, for example:

# private_key_jwt client authentication

quarkus.oidc-client.auth-server-url=http://localhost:8180/auth/realms/quarkus/
quarkus.oidc-client.client-id=quarkus-app
quarkus.oidc-client.credentials.jwt.key-file=privateKey.pem

# This is a token key identifier 'kid' header - set it if your OpenID Connect provider requires it.
# Note that if the key is represented in a JSON Web Key (JWK) format with a `kid` property, then
# using 'quarkus.oidc-client.credentials.jwt.token-key-id' is unnecessary.
quarkus.oidc-client.credentials.jwt.token-key-id=mykey

# Use the RS512 signature algorithm instead of the default RS256
quarkus.oidc-client.credentials.jwt.signature-algorithm=RS512

# The token endpoint URL is the default audience value; use the base address URL instead:
quarkus.oidc-client.credentials.jwt.audience=${quarkus.oidc-client.auth-server-url}

# custom subject instead of the client ID:
quarkus.oidc-client.credentials.jwt.subject=custom-subject

# custom issuer instead of the client ID:
quarkus.oidc-client.credentials.jwt.issuer=custom-issuer

JWT Bearer

RFC7523 explains how JWT Bearer tokens can be used to authenticate clients, see the Using JWTs for Client Authentication section for more information.

It can be enabled as follows:

quarkus.oidc-client.auth-server-url=${auth-server-url}
quarkus.oidc-client.client-id=quarkus-app
quarkus.oidc-client.credentials.jwt.source=bearer

Next, the JWT bearer token must be provided as a client_assertion parameter to the OIDC client.

You can use OidcClient methods for acquiring or refreshing tokens which accept additional grant parameters, for example, oidcClient.getTokens(Map.of("client_assertion", "ey…")).

If you work work with the OIDC client filters then you must register a custom filter which will provide this assertion.

Here is an example of the Quarkus REST (formerly RESTEasy Reactive) custom filter:

package io.quarkus.it.keycloak;

import java.util.Map;

import io.quarkus.oidc.client.reactive.filter.runtime.AbstractOidcClientRequestReactiveFilter;
import io.quarkus.oidc.common.runtime.OidcConstants;
import jakarta.annotation.Priority;
import jakarta.ws.rs.Priorities;

@Priority(Priorities.AUTHENTICATION)
public class OidcClientRequestCustomFilter extends AbstractOidcClientRequestReactiveFilter {

    @Override
    protected Map<String, String> additionalParameters() {
        return Map.of(OidcConstants.CLIENT_ASSERTION, "ey...");
    }
}

Here is an example of the RestEasy Classic custom filter:

package io.quarkus.it.keycloak;

import java.util.Map;

import io.quarkus.oidc.client.filter.runtime.AbstractOidcClientRequestFilter;
import io.quarkus.oidc.common.runtime.OidcConstants;
import jakarta.annotation.Priority;
import jakarta.ws.rs.Priorities;

@Priority(Priorities.AUTHENTICATION)
public class OidcClientRequestCustomFilter extends AbstractOidcClientRequestFilter {

    @Override
    protected Map<String, String> additionalParameters() {
        return Map.of(OidcConstants.CLIENT_ASSERTION, "ey...");
    }
}

Apple POST JWT

Apple OpenID Connect Provider uses a client_secret_post method where a secret is a JWT produced with a private_key_jwt authentication method but with Apple account-specific issuer and subject properties.

quarkus-oidc-client supports a non-standard client_secret_post_jwt authentication method, which can be configured as follows:

quarkus.oidc-client.auth-server-url=${apple.url}
quarkus.oidc-client.client-id=${apple.client-id}
quarkus.oidc-client.credentials.client-secret.method=post-jwt

quarkus.oidc-client.credentials.jwt.key-file=ecPrivateKey.pem
quarkus.oidc-client.credentials.jwt.signature-algorithm=ES256
quarkus.oidc-client.credentials.jwt.subject=${apple.subject}
quarkus.oidc-client.credentials.jwt.issuer=${apple.issuer}

Mutual TLS

Some OpenID Connect Providers require that a client is authenticated as part of the mutual TLS (mTLS) authentication process.

quarkus-oidc-client can be configured as follows to support mTLS:

quarkus.oidc-client.tls.verification=certificate-validation

# Keystore configuration
quarkus.oidc-client.tls.key-store-file=client-keystore.jks
quarkus.oidc-client.tls.key-store-password=${key-store-password}

# Add more keystore properties if needed:
#quarkus.oidc-client.tls.key-store-alias=keyAlias
#quarkus.oidc-client.tls.key-store-alias-password=keyAliasPassword

# Truststore configuration
quarkus.oidc-client.tls.trust-store-file=client-truststore.jks
quarkus.oidc-client.tls.trust-store-password=${trust-store-password}
# Add more truststore properties if needed:
#quarkus.oidc-client.tls.trust-store-alias=certAlias

Probando

Start by adding the following dependencies to your test project:

<dependency>
    <groupId>io.quarkus</groupId>
    <artifactId>quarkus-junit5</artifactId>
    <scope>test</scope>
</dependency>
<dependency>
    <groupId>org.awaitility</groupId>
    <artifactId>awaitility</artifactId>
    <scope>test</scope>
</dependency>

Wiremock

Add the following dependencies to your test project:

<dependency>
    <groupId>org.wiremock</groupId>
    <artifactId>wiremock</artifactId>
    <scope>test</scope>
</dependency>

Write a Wiremock-based QuarkusTestResourceLifecycleManager, for example:

package io.quarkus.it.keycloak;

import static com.github.tomakehurst.wiremock.client.WireMock.matching;
import static com.github.tomakehurst.wiremock.core.WireMockConfiguration.wireMockConfig;

import java.util.HashMap;
import java.util.Map;

import com.github.tomakehurst.wiremock.WireMockServer;
import com.github.tomakehurst.wiremock.client.WireMock;
import com.github.tomakehurst.wiremock.core.Options.ChunkedEncodingPolicy;

import io.quarkus.test.common.QuarkusTestResourceLifecycleManager;

public class KeycloakRealmResourceManager implements QuarkusTestResourceLifecycleManager {
    private WireMockServer server;

    @Override
    public Map<String, String> start() {

        server = new WireMockServer(wireMockConfig().dynamicPort().useChunkedTransferEncoding(ChunkedEncodingPolicy.NEVER));
        server.start();

        server.stubFor(WireMock.post("/tokens")
                .withRequestBody(matching("grant_type=password&username=alice&password=alice"))
                .willReturn(WireMock
                        .aResponse()
                        .withHeader("Content-Type", "application/json")
                        .withBody(
                                "{\"access_token\":\"access_token_1\", \"expires_in\":4, \"refresh_token\":\"refresh_token_1\"}")));
        server.stubFor(WireMock.post("/tokens")
                .withRequestBody(matching("grant_type=refresh_token&refresh_token=refresh_token_1"))
                .willReturn(WireMock
                        .aResponse()
                        .withHeader("Content-Type", "application/json")
                        .withBody(
                                "{\"access_token\":\"access_token_2\", \"expires_in\":4, \"refresh_token\":\"refresh_token_1\"}")));


        Map<String, String> conf = new HashMap<>();
        conf.put("keycloak.url", server.baseUrl());
        return conf;
    }

    @Override
    public synchronized void stop() {
        if (server != null) {
            server.stop();
            server = null;
        }
    }
}

Prepare the REST test endpoints. You can have the test front-end endpoint, which uses the injected MP REST client with a registered OidcClient filter, call the downstream endpoint. This endpoint echoes the token back. For example, see the integration-tests/oidc-client-wiremock in the main Quarkus repository.

Set application.properties, for example:

# Use the 'keycloak.url' property set by the test KeycloakRealmResourceManager
quarkus.oidc-client.auth-server-url=${keycloak.url}
quarkus.oidc-client.discovery-enabled=false
quarkus.oidc-client.token-path=/tokens
quarkus.oidc-client.client-id=quarkus-service-app
quarkus.oidc-client.credentials.secret=secret
quarkus.oidc-client.grant.type=password
quarkus.oidc-client.grant-options.password.username=alice
quarkus.oidc-client.grant-options.password.password=alice

And finally, write the test code. Given the Wiremock-based resource above, the first test invocation should return the access_token_1 access token, which will expire in 4 seconds. Use awaitility to wait for about 5 seconds, and now the next test invocation should return the access_token_2 access token, which confirms the expired access_token_1 access token has been refreshed.

Keycloak

If you work with Keycloak, you can use the same approach described in the OpenID Connect Bearer Token Integration testing Keycloak section.

How to check the errors in the logs

Enable io.quarkus.oidc.client.runtime.OidcClientImpl TRACE level logging to see more details about the token acquisition and refresh errors:

quarkus.log.category."io.quarkus.oidc.client.runtime.OidcClientImpl".level=TRACE
quarkus.log.category."io.quarkus.oidc.client.runtime.OidcClientImpl".min-level=TRACE

Enable io.quarkus.oidc.client.runtime.OidcClientRecorder TRACE level logging to see more details about the OidcClient initialization errors:

quarkus.log.category."io.quarkus.oidc.client.runtime.OidcClientRecorder".level=TRACE
quarkus.log.category."io.quarkus.oidc.client.runtime.OidcClientRecorder".min-level=TRACE

OIDC request filters

You can filter OIDC requests made by Quarkus to the OIDC provider by registering one or more OidcRequestFilter implementations, which can update or add new request headers. For example, a filter can analyze the request body and add its digest as a new header value:

package io.quarkus.it.keycloak;

import jakarta.enterprise.context.ApplicationScoped;

import io.quarkus.arc.Unremovable;
import io.quarkus.oidc.common.OidcRequestContextProperties;
import io.quarkus.oidc.common.OidcRequestFilter;
import io.vertx.core.http.HttpMethod;
import io.vertx.mutiny.core.buffer.Buffer;
import io.vertx.mutiny.ext.web.client.HttpRequest;

@ApplicationScoped
@Unremovable
public class OidcRequestCustomizer implements OidcRequestFilter {

    @Override
    public void filter(HttpRequest<Buffer> request, Buffer buffer, OidcRequestContextProperties contextProperties) {
        HttpMethod method = request.method();
        String uri = request.uri();
        if (method == HttpMethod.POST && uri.endsWith("/service") && buffer != null) {
            request.putHeader("Digest", calculateDigest(buffer.toString()));
        }
    }

    private String calculateDigest(String bodyString) {
        // Apply the required digest algorithm to the body string
    }
}

Token Propagation Reactive

The quarkus-rest-client-oidc-token-propagation extension provides a REST Client, io.quarkus.oidc.token.propagation.reactive.AccessTokenRequestReactiveFilter, that simplifies the propagation of authentication information. This client propagates the bearer token present in the currently active request or the token acquired from the authorization code flow mechanism as the HTTP Authorization header’s Bearer scheme value.

You can selectively register AccessTokenRequestReactiveFilter by using either io.quarkus.oidc.token.propagation.AccessToken or org.eclipse.microprofile.rest.client.annotation.RegisterProvider annotation, for example:

import org.eclipse.microprofile.rest.client.inject.RegisterRestClient;
import io.quarkus.oidc.token.propagation.AccessToken;

@RegisterRestClient
@AccessToken
@Path("/")
public interface ProtectedResourceService {

    @GET
    String getUserName();
}

import org.eclipse.microprofile.rest.client.annotation.RegisterProvider;
import org.eclipse.microprofile.rest.client.inject.RegisterRestClient;
import io.quarkus.oidc.token.propagation.reactive.AccessTokenRequestReactiveFilter;

@RegisterRestClient
@RegisterProvider(AccessTokenRequestReactiveFilter.class)
@Path("/")
public interface ProtectedResourceService {

    @GET
    String getUserName();
}

Additionally, AccessTokenRequestReactiveFilter can support a complex application that needs to exchange the tokens before propagating them.

If you work with Keycloak or another OIDC provider that supports a Token Exchange token grant, then you can configure AccessTokenRequestReactiveFilter to exchange the token like this:

quarkus.oidc-client.auth-server-url=http://localhost:8180/auth/realms/quarkus
quarkus.oidc-client.client-id=quarkus-app
quarkus.oidc-client.credentials.secret=secret
quarkus.oidc-client.grant.type=exchange
quarkus.oidc-client.grant-options.exchange.audience=quarkus-app-exchange

quarkus.oidc-token-propagation.exchange-token=true (1)

1	Please note that the `exchange-token` configuration property is ignored when the OidcClient name is set with the `io.quarkus.oidc.token.propagation.AccessToken#exchangeTokenClient` annotation attribute.

Note AccessTokenRequestReactiveFilter will use OidcClient to exchange the current token, and you can use quarkus.oidc-client.grant-options.exchange to set the additional exchange properties expected by your OpenID Connect Provider.

If you work with providers such as Azure that require using JWT bearer token grant to exchange the current token, then you can configure AccessTokenRequestReactiveFilter to exchange the token like this:

quarkus.oidc-client.auth-server-url=${azure.provider.url}
quarkus.oidc-client.client-id=quarkus-app
quarkus.oidc-client.credentials.secret=secret

quarkus.oidc-client.grant.type=jwt
quarkus.oidc-client.grant-options.jwt.requested_token_use=on_behalf_of
quarkus.oidc-client.scopes=https://graph.microsoft.com/user.read,offline_access

quarkus.oidc-token-propagation.exchange-token=true

AccessTokenRequestReactiveFilter uses a default OidcClient by default. A named OidcClient can be selected with a quarkus.oidc-token-propagation-reactive.client-name configuration property or with the io.quarkus.oidc.token.propagation.AccessToken#exchangeTokenClient annotation attribute.

Token Propagation

The quarkus-resteasy-client-oidc-token-propagation extension provides two Jakarta REST jakarta.ws.rs.client.ClientRequestFilter class implementations that simplify the propagation of authentication information. io.quarkus.oidc.token.propagation.AccessTokenRequestFilter propagates the Bearer token present in the current active request or the token acquired from the Authorization code flow mechanism, as the HTTP Authorization header’s Bearer scheme value. The io.quarkus.oidc.token.propagation.JsonWebTokenRequestFilter provides the same functionality but, in addition, provides support for JWT tokens.

When you need to propagate the current Authorization Code Flow access token, then the immediate token propagation will work well - as the code flow access tokens (as opposed to ID tokens) are meant to be propagated for the current Quarkus endpoint to access the remote services on behalf of the currently authenticated user.

However, the direct end-to-end Bearer token propagation should be avoided. For example, Client → Service A → Service B where Service B receives a token sent by Client to Service A. In such cases, Service B cannot distinguish if the token came from Service A or from Client directly. For Service B to verify the token came from Service A, it should be able to assert a new issuer and audience claims.

Additionally, a complex application might need to exchange or update the tokens before propagating them. For example, the access context might be different when Service A is accessing Service B. In this case, Service A might be granted a narrow or completely different set of scopes to access Service B.

The following sections show how AccessTokenRequestFilter and JsonWebTokenRequestFilter can help.

RestClient AccessTokenRequestFilter

AccessTokenRequestFilter treats all tokens as Strings, and as such, it can work with both JWT and opaque tokens.

You can selectively register AccessTokenRequestFilter by using either io.quarkus.oidc.token.propagation.AccessToken or org.eclipse.microprofile.rest.client.annotation.RegisterProvider, for example:

import org.eclipse.microprofile.rest.client.inject.RegisterRestClient;
import io.quarkus.oidc.token.propagation.AccessToken;

@RegisterRestClient
@AccessToken
@Path("/")
public interface ProtectedResourceService {

    @GET
    String getUserName();
}

import org.eclipse.microprofile.rest.client.annotation.RegisterProvider;
import org.eclipse.microprofile.rest.client.inject.RegisterRestClient;
import io.quarkus.oidc.token.propagation.AccessTokenRequestFilter;

@RegisterRestClient
@RegisterProvider(AccessTokenRequestFilter.class)
@Path("/")
public interface ProtectedResourceService {

    @GET
    String getUserName();
}

Alternatively, AccessTokenRequestFilter can be registered automatically with all MP Rest or Jakarta REST clients if the quarkus.oidc-token-propagation.register-filter property is set to true and quarkus.oidc-token-propagation.json-web-token property is set to false (which is a default value).

Exchange token before propagation

If the current access token needs to be exchanged before propagation and you work with Keycloak or other OpenID Connect Provider which supports a Token Exchange token grant, then you can configure AccessTokenRequestFilter like this:

quarkus.oidc-client.auth-server-url=http://localhost:8180/auth/realms/quarkus
quarkus.oidc-client.client-id=quarkus-app
quarkus.oidc-client.credentials.secret=secret
quarkus.oidc-client.grant.type=exchange
quarkus.oidc-client.grant-options.exchange.audience=quarkus-app-exchange

quarkus.oidc-token-propagation.exchange-token=true

If you work with providers such as Azure that require using JWT bearer token grant to exchange the current token, then you can configure AccessTokenRequestFilter to exchange the token like this:

quarkus.oidc-client.auth-server-url=${azure.provider.url}
quarkus.oidc-client.client-id=quarkus-app
quarkus.oidc-client.credentials.secret=secret

quarkus.oidc-client.grant.type=jwt
quarkus.oidc-client.grant-options.jwt.requested_token_use=on_behalf_of
quarkus.oidc-client.scopes=https://graph.microsoft.com/user.read,offline_access

quarkus.oidc-token-propagation.exchange-token=true

Note AccessTokenRequestFilter will use OidcClient to exchange the current token, and you can use quarkus.oidc-client.grant-options.exchange to set the additional exchange properties expected by your OpenID Connect Provider.

AccessTokenRequestFilter uses a default OidcClient by default. A named OidcClient can be selected with a quarkus.oidc-token-propagation.client-name configuration property.

RestClient JsonWebTokenRequestFilter

Using JsonWebTokenRequestFilter is recommended if you work with Bearer JWT tokens where these tokens can have their claims, such as issuer and audience modified and the updated tokens secured (for example, re-signed) again. It expects an injected org.eclipse.microprofile.jwt.JsonWebToken and, therefore, will not work with the opaque tokens. Also, if your OpenID Connect Provider supports a Token Exchange protocol, then it is recommended to use AccessTokenRequestFilter instead - as both JWT and opaque bearer tokens can be securely exchanged with AccessTokenRequestFilter.

JsonWebTokenRequestFilter makes it easy for Service A implementations to update the injected org.eclipse.microprofile.jwt.JsonWebToken with the new issuer and audience claim values and secure the updated token again with a new signature. The only difficult step is ensuring that Service A has a signing key; it should be provisioned from a secure file system or remote secure storage such as Vault.

You can selectively register JsonWebTokenRequestFilter by using either io.quarkus.oidc.token.propagation.JsonWebToken or org.eclipse.microprofile.rest.client.annotation.RegisterProvider, for example:

import org.eclipse.microprofile.rest.client.inject.RegisterRestClient;
import io.quarkus.oidc.token.propagation.JsonWebToken;

@RegisterRestClient
@JsonWebToken
@Path("/")
public interface ProtectedResourceService {

    @GET
    String getUserName();
}

import org.eclipse.microprofile.rest.client.annotation.RegisterProvider;
import org.eclipse.microprofile.rest.client.inject.RegisterRestClient;
import io.quarkus.oidc.token.propagation.JsonWebTokenRequestFilter;

@RegisterRestClient
@RegisterProvider(JsonWebTokenRequestFilter.class)
@Path("/")
public interface ProtectedResourceService {

    @GET
    String getUserName();
}

Alternatively, JsonWebTokenRequestFilter can be registered automatically with all MicroProfile REST or Jakarta REST clients if both quarkus.oidc-token-propagation.register-filter and quarkus.resteasy-client-oidc-token-propagation.json-web-token properties are set to true.

Update token before propagation

If the injected token needs to have its iss (issuer) or aud (audience) claims updated and secured again with a new signature, then you can configure JsonWebTokenRequestFilter like this:

quarkus.resteasy-client-oidc-token-propagation.secure-json-web-token=true
smallrye.jwt.sign.key.location=/privateKey.pem
# Set a new issuer
smallrye.jwt.new-token.issuer=http://frontend-resource
# Set a new audience
smallrye.jwt.new-token.audience=http://downstream-resource
# Override the existing token issuer and audience claims if they are already set
smallrye.jwt.new-token.override-matching-claims=true

As mentioned, use AccessTokenRequestFilter if you work with Keycloak or an OpenID Connect Provider that supports a Token Exchange protocol.

Probando

You can generate the tokens as described in OpenID Connect Bearer Token Integration testing section. Prepare the REST test endpoints. You can have the test front-end endpoint, which uses the injected MP REST client with a registered token propagation filter, call the downstream endpoint. For example, see the integration-tests/resteasy-client-oidc-token-propagation in the main Quarkus repository.

Token Propagation Reactive

Add the following Maven Dependency:

<dependency>
    <groupId>io.quarkus</groupId>
    <artifactId>quarkus-rest-client-resteasy-client-oidc-token-propagation</artifactId>
</dependency>

The quarkus-rest-client-resteasy-client-oidc-token-propagation extension provides io.quarkus.oidc.token.propagation.reactive.AccessTokenRequestReactiveFilter which can be used to propagate the current Bearer or Authorization Code Flow access tokens.

The quarkus-rest-client-resteasy-client-oidc-token-propagation extension (as opposed to the non-reactive quarkus-resteasy-client-oidc-token-propagation extension) does not currently support the exchanging or resigning of the tokens before the propagation. However, these features might be added in the future.

GraphQL client integration

The quarkus-oidc-client-graphql extension provides a way to integrate an OIDC client into GraphQL clients paralleling the approach used with REST clients. When this extension is active, any GraphQL client configured through properties (rather than programmatically by the builder) will use the OIDC client to acquire an access token, which it will then set as the Authorization header value. The OIDC client will also refresh expired access tokens.

To configure which OIDC client should be used by the GraphQL client, select one of the configured OIDC clients with the quarkus.oidc-client-graphql.client-name property, for example:

quarkus.oidc-client-graphql.client-name=oidc-client-for-graphql

# example declaration of the OIDC client itself
quarkus.oidc-client.oidc-client-for-graphql.auth-server-url=${keycloak.url}
quarkus.oidc-client.oidc-client-for-graphql.grant.type=password
quarkus.oidc-client.oidc-client-for-graphql.grant-options.password.username=${username}
quarkus.oidc-client.oidc-client-for-graphql.grant-options.password.password=${password}
quarkus.oidc-client.oidc-client-for-graphql.client-id=${quarkus.oidc.client-id}
quarkus.oidc-client.oidc-client-for-graphql.credentials.client-secret.value=${keycloak.credentials.secret}
quarkus.oidc-client.oidc-client-for-graphql.credentials.client-secret.method=POST

If you don’t specify the quarkus.oidc-client-graphql.client-name property, GraphQL clients will use the default OIDC client (without an explicit name).

Specifically for type-safe GraphQL clients, you can override this on a per-client basis by annotating the GraphQLClientApi interface with @io.quarkus.oidc.client.filter.OidcClientFilter. For example:

@GraphQLClientApi(configKey = "order-client")
@OidcClientFilter("oidc-client-for-graphql")
public interface OrdersGraphQLClient {
    // Queries, mutations, and subscriptions go here.
}

To be able to use this with a programmatically created GraphQL client, both builders (VertxDynamicGraphQLClientBuilder and VertxTypesafeGraphQLClientBuilder) contain a method dynamicHeader(String, Uni<String>) that allows you to plug in a header that might change for every request. To plug an OIDC client into it, use

@Inject
OidcClients oidcClients;

VertxTypesafeGraphQLClientBuilder builder = ....;
Uni<String> tokenUni = oidcClients.getClient("OIDC_CLIENT_NAME")
    .getTokens().map(t -> "Bearer " + t.getAccessToken());
builder.dynamicHeader("Authorization", tokenUni);
VertxDynamicGraphQLClient client = builder.build();

Referencia de configuración

OIDC client

Configuration property fixed at build time - All other configuration properties are overridable at runtime

Configuration property	Tipo	Por defecto
`quarkus.oidc-client.enabled` If the OIDC client extension is enabled. Environment variable: `QUARKUS_OIDC_CLIENT_ENABLED` Show more	boolean	`true`
`quarkus.oidc-client.auth-server-url` The base URL of the OpenID Connect (OIDC) server, for example, `https://host:port/auth`. Do not set this property if the public key verification (`public-key`) or certificate chain verification only (`certificate-chain`) is required. The OIDC discovery endpoint is called by default by appending a `.well-known/openid-configuration` path to this URL. For Keycloak, use `https://host:port/realms/{realm}`, replacing `{realm}` with the Keycloak realm name. Environment variable: `QUARKUS_OIDC_CLIENT_AUTH_SERVER_URL` Show more	string
`quarkus.oidc-client.discovery-enabled` Discovery of the OIDC endpoints. If not enabled, you must configure the OIDC endpoint URLs individually. Environment variable: `QUARKUS_OIDC_CLIENT_DISCOVERY_ENABLED` Show more	boolean	`true`
`quarkus.oidc-client.token-path` The OIDC token endpoint that issues access and refresh tokens; specified as a relative path or absolute URL. Set if `discovery-enabled` is `false` or a discovered token endpoint path must be customized. Environment variable: `QUARKUS_OIDC_CLIENT_TOKEN_PATH` Show more	string
`quarkus.oidc-client.revoke-path` The relative path or absolute URL of the OIDC token revocation endpoint. Environment variable: `QUARKUS_OIDC_CLIENT_REVOKE_PATH` Show more	string
`quarkus.oidc-client.client-id` The client id of the application. Each application has a client id that is used to identify the application. Setting the client id is not required if `application-type` is `service` and no token introspection is required. Environment variable: `QUARKUS_OIDC_CLIENT_CLIENT_ID` Show more	string
`quarkus.oidc-client.connection-delay` The duration to attempt the initial connection to an OIDC server. For example, setting the duration to `20S` allows 10 retries, each 2 seconds apart. This property is only effective when the initial OIDC connection is created. For dropped connections, use the `connection-retry-count` property instead. Environment variable: `QUARKUS_OIDC_CLIENT_CONNECTION_DELAY` Show more	Duration
`quarkus.oidc-client.connection-retry-count` The number of times to retry re-establishing an existing OIDC connection if it is temporarily lost. Different from `connection-delay`, which applies only to initial connection attempts. For instance, if a request to the OIDC token endpoint fails due to a connection issue, it will be retried as per this setting. Environment variable: `QUARKUS_OIDC_CLIENT_CONNECTION_RETRY_COUNT` Show more	int	`3`
`quarkus.oidc-client.connection-timeout` The number of seconds after which the current OIDC connection request times out. Environment variable: `QUARKUS_OIDC_CLIENT_CONNECTION_TIMEOUT` Show more	Duration	`10S`
`quarkus.oidc-client.use-blocking-dns-lookup` Whether DNS lookup should be performed on the worker thread. Use this option when you can see logged warnings about blocked Vert.x event loop by HTTP requests to OIDC server. Environment variable: `QUARKUS_OIDC_CLIENT_USE_BLOCKING_DNS_LOOKUP` Show more	boolean	`false`
`quarkus.oidc-client.max-pool-size` The maximum size of the connection pool used by the WebClient. Environment variable: `QUARKUS_OIDC_CLIENT_MAX_POOL_SIZE` Show more	int
`quarkus.oidc-client.credentials.secret` The client secret used by the `client_secret_basic` authentication method. Must be set unless a secret is set in `client-secret` or `jwt` client authentication is required. You can use `client-secret.value` instead, but both properties are mutually exclusive. Environment variable: `QUARKUS_OIDC_CLIENT_CREDENTIALS_SECRET` Show more	string
`quarkus.oidc-client.credentials.client-secret.value` The client secret value. This value is ignored if `credentials.secret` is set. Must be set unless a secret is set in `client-secret` or `jwt` client authentication is required. Environment variable: `QUARKUS_OIDC_CLIENT_CREDENTIALS_CLIENT_SECRET_VALUE` Show more	string
`quarkus.oidc-client.credentials.client-secret.provider.name` The CredentialsProvider name, which should only be set if more than one CredentialsProvider is registered Environment variable: `QUARKUS_OIDC_CLIENT_CREDENTIALS_CLIENT_SECRET_PROVIDER_NAME` Show more	string
`quarkus.oidc-client.credentials.client-secret.provider.key` The CredentialsProvider client secret key Environment variable: `QUARKUS_OIDC_CLIENT_CREDENTIALS_CLIENT_SECRET_PROVIDER_KEY` Show more	string
`quarkus.oidc-client.credentials.client-secret.method` The authentication method. If the `clientSecret.value` secret is set, this method is `basic` by default. Environment variable: `QUARKUS_OIDC_CLIENT_CREDENTIALS_CLIENT_SECRET_METHOD` Show more	`basicclient_secret_basic` (default): The client id and secret are submitted with the HTTP Authorization Basic scheme., `postclient_secret_post`: The client id and secret are submitted as the `client_id` and `client_secret` form parameters., `post-jwtclient_secret_jwt`: The client id and generated JWT secret are submitted as the `client_id` and `client_secret` form parameters., `query`client id and secret are submitted as HTTP query parameters. This option is only supported by the OIDC extension.
`quarkus.oidc-client.credentials.jwt.source` JWT token source: OIDC provider client or an existing JWT bearer token. Environment variable: `QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_SOURCE` Show more	`client`, `bearer`	`client`
`quarkus.oidc-client.credentials.jwt.secret` If provided, indicates that JWT is signed using a secret key. Environment variable: `QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_SECRET` Show more	string
`quarkus.oidc-client.credentials.jwt.secret-provider.name` The CredentialsProvider name, which should only be set if more than one CredentialsProvider is registered Environment variable: `QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_SECRET_PROVIDER_NAME` Show more	string
`quarkus.oidc-client.credentials.jwt.secret-provider.key` The CredentialsProvider client secret key Environment variable: `QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_SECRET_PROVIDER_KEY` Show more	string
`quarkus.oidc-client.credentials.jwt.key-file` If provided, indicates that JWT is signed using a private key in PEM or JWK format. You can use the `signature-algorithm` property to override the default key algorithm, `RS256`. Environment variable: `QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_KEY_FILE` Show more	string
`quarkus.oidc-client.credentials.jwt.key-store-file` If provided, indicates that JWT is signed using a private key from a keystore. Environment variable: `QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_KEY_STORE_FILE` Show more	string
`quarkus.oidc-client.credentials.jwt.key-store-password` A parameter to specify the password of the keystore file. Environment variable: `QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_KEY_STORE_PASSWORD` Show more	string
`quarkus.oidc-client.credentials.jwt.key-id` The private key id or alias. Environment variable: `QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_KEY_ID` Show more	string
`quarkus.oidc-client.credentials.jwt.key-password` The private key password. Environment variable: `QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_KEY_PASSWORD` Show more	string
`quarkus.oidc-client.credentials.jwt.audience` The JWT audience (`aud`) claim value. By default, the audience is set to the address of the OpenId Connect Provider’s token endpoint. Environment variable: `QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_AUDIENCE` Show more	string
`quarkus.oidc-client.credentials.jwt.token-key-id` The key identifier of the signing key added as a JWT `kid` header. Environment variable: `QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_TOKEN_KEY_ID` Show more	string
`quarkus.oidc-client.credentials.jwt.issuer` The issuer of the signing key added as a JWT `iss` claim. The default value is the client id. Environment variable: `QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_ISSUER` Show more	string
`quarkus.oidc-client.credentials.jwt.subject` Subject of the signing key added as a JWT `sub` claim The default value is the client id. Environment variable: `QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_SUBJECT` Show more	string
`quarkus.oidc-client.credentials.jwt.signature-algorithm` The signature algorithm used for the `key-file` property. Supported values: `RS256` (default), `RS384`, `RS512`, `PS256`, `PS384`, `PS512`, `ES256`, `ES384`, `ES512`, `HS256`, `HS384`, `HS512`. Environment variable: `QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_SIGNATURE_ALGORITHM` Show more	string
`quarkus.oidc-client.credentials.jwt.lifespan` The JWT lifespan in seconds. This value is added to the time at which the JWT was issued to calculate the expiration time. Environment variable: `QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_LIFESPAN` Show more	int	`10`
`quarkus.oidc-client.proxy.host` The host name or IP address of the Proxy. Note: If the OIDC adapter requires a Proxy to talk with the OIDC server (Provider), set this value to enable the usage of a Proxy. Environment variable: `QUARKUS_OIDC_CLIENT_PROXY_HOST` Show more	string
`quarkus.oidc-client.proxy.port` The port number of the Proxy. The default value is `80`. Environment variable: `QUARKUS_OIDC_CLIENT_PROXY_PORT` Show more	int	`80`
`quarkus.oidc-client.proxy.username` The username, if the Proxy needs authentication. Environment variable: `QUARKUS_OIDC_CLIENT_PROXY_USERNAME` Show more	string
`quarkus.oidc-client.proxy.password` The password, if the Proxy needs authentication. Environment variable: `QUARKUS_OIDC_CLIENT_PROXY_PASSWORD` Show more	string
`quarkus.oidc-client.tls.verification` Certificate validation and hostname verification, which can be one of the following `Verification` values. Default is `required`. Environment variable: `QUARKUS_OIDC_CLIENT_TLS_VERIFICATION` Show more	`required`Certificates are validated and hostname verification is enabled. This is the default value., `certificate-validation`Certificates are validated but hostname verification is disabled., `none`All certificates are trusted and hostname verification is disabled.
`quarkus.oidc-client.tls.key-store-file` An optional keystore that holds the certificate information instead of specifying separate files. Environment variable: `QUARKUS_OIDC_CLIENT_TLS_KEY_STORE_FILE` Show more	path
`quarkus.oidc-client.tls.key-store-file-type` The type of the keystore file. If not given, the type is automatically detected based on the file name. Environment variable: `QUARKUS_OIDC_CLIENT_TLS_KEY_STORE_FILE_TYPE` Show more	string
`quarkus.oidc-client.tls.key-store-provider` The provider of the keystore file. If not given, the provider is automatically detected based on the keystore file type. Environment variable: `QUARKUS_OIDC_CLIENT_TLS_KEY_STORE_PROVIDER` Show more	string
`quarkus.oidc-client.tls.key-store-password` The password of the keystore file. If not given, the default value, `password`, is used. Environment variable: `QUARKUS_OIDC_CLIENT_TLS_KEY_STORE_PASSWORD` Show more	string
`quarkus.oidc-client.tls.key-store-key-alias` The alias of a specific key in the keystore. When SNI is disabled, if the keystore contains multiple keys and no alias is specified, the behavior is undefined. Environment variable: `QUARKUS_OIDC_CLIENT_TLS_KEY_STORE_KEY_ALIAS` Show more	string
`quarkus.oidc-client.tls.key-store-key-password` The password of the key, if it is different from the `key-store-password`. Environment variable: `QUARKUS_OIDC_CLIENT_TLS_KEY_STORE_KEY_PASSWORD` Show more	string
`quarkus.oidc-client.tls.trust-store-file` The truststore that holds the certificate information of the certificates to trust. Environment variable: `QUARKUS_OIDC_CLIENT_TLS_TRUST_STORE_FILE` Show more	path
`quarkus.oidc-client.tls.trust-store-password` The password of the truststore file. Environment variable: `QUARKUS_OIDC_CLIENT_TLS_TRUST_STORE_PASSWORD` Show more	string
`quarkus.oidc-client.tls.trust-store-cert-alias` The alias of the truststore certificate. Environment variable: `QUARKUS_OIDC_CLIENT_TLS_TRUST_STORE_CERT_ALIAS` Show more	string
`quarkus.oidc-client.tls.trust-store-file-type` The type of the truststore file. If not given, the type is automatically detected based on the file name. Environment variable: `QUARKUS_OIDC_CLIENT_TLS_TRUST_STORE_FILE_TYPE` Show more	string
`quarkus.oidc-client.tls.trust-store-provider` The provider of the truststore file. If not given, the provider is automatically detected based on the truststore file type. Environment variable: `QUARKUS_OIDC_CLIENT_TLS_TRUST_STORE_PROVIDER` Show more	string
`quarkus.oidc-client.id` A unique OIDC client identifier. It must be set when OIDC clients are created dynamically and is optional in all other cases. Environment variable: `QUARKUS_OIDC_CLIENT_ID` Show more	string
`quarkus.oidc-client.client-enabled` If this client configuration is enabled. Environment variable: `QUARKUS_OIDC_CLIENT_CLIENT_ENABLED` Show more	boolean	`true`
`quarkus.oidc-client.scopes` List of access token scopes Environment variable: `QUARKUS_OIDC_CLIENT_SCOPES` Show more	list of string
`quarkus.oidc-client.refresh-token-time-skew` Refresh token time skew in seconds. If this property is enabled then the configured number of seconds is added to the current time when checking whether the access token should be refreshed. If the sum is greater than this access token’s expiration time then a refresh is going to happen. Environment variable: `QUARKUS_OIDC_CLIENT_REFRESH_TOKEN_TIME_SKEW` Show more	Duration
`quarkus.oidc-client.absolute-expires-in` If the access token 'expires_in' property should be checked as an absolute time value as opposed to a duration relative to the current time. Environment variable: `QUARKUS_OIDC_CLIENT_ABSOLUTE_EXPIRES_IN` Show more	boolean	`false`
`quarkus.oidc-client.grant.type` Grant type Environment variable: `QUARKUS_OIDC_CLIENT_GRANT_TYPE` Show more	`client`'client_credentials' grant requiring an OIDC client authentication only, `password`'password' grant requiring both OIDC client and user ('username' and 'password') authentications, `code`'authorization_code' grant requiring an OIDC client authentication as well as at least 'code' and 'redirect_uri' parameters which must be passed to OidcClient at the token request time., `exchange`'urn:ietf:params:oauth:grant-type:token-exchange' grant requiring an OIDC client authentication as well as at least 'subject_token' parameter which must be passed to OidcClient at the token request time., `jwt`'urn:ietf:params:oauth:grant-type:jwt-bearer' grant requiring an OIDC client authentication as well as at least an 'assertion' parameter which must be passed to OidcClient at the token request time., `refresh`'refresh_token' grant requiring an OIDC client authentication and a refresh token. Note, OidcClient supports this grant by default if an access token acquisition response contained a refresh token. However, in some cases, the refresh token is provided out of band, for example, it can be shared between several of the confidential client’s services, etc. If 'quarkus.oidc-client.grant-type' is set to 'refresh' then `OidcClient` will only support refreshing the tokens., `ciba`'urn:openid:params:grant-type:ciba' grant requiring an OIDC client authentication as well as 'auth_req_id' parameter which must be passed to OidcClient at the token request time., `device`'urn:ietf:params:oauth:grant-type:device_code' grant requiring an OIDC client authentication as well as 'device_code' parameter which must be passed to OidcClient at the token request time.	`client`
`quarkus.oidc-client.grant.access-token-property` Access token property name in a token grant response Environment variable: `QUARKUS_OIDC_CLIENT_GRANT_ACCESS_TOKEN_PROPERTY` Show more	string	`access_token`
`quarkus.oidc-client.grant.refresh-token-property` Refresh token property name in a token grant response Environment variable: `QUARKUS_OIDC_CLIENT_GRANT_REFRESH_TOKEN_PROPERTY` Show more	string	`refresh_token`
`quarkus.oidc-client.grant.expires-in-property` Access token expiry property name in a token grant response Environment variable: `QUARKUS_OIDC_CLIENT_GRANT_EXPIRES_IN_PROPERTY` Show more	string	`expires_in`
`quarkus.oidc-client.grant.refresh-expires-in-property` Refresh token expiry property name in a token grant response Environment variable: `QUARKUS_OIDC_CLIENT_GRANT_REFRESH_EXPIRES_IN_PROPERTY` Show more	string	`refresh_expires_in`
`quarkus.oidc-client.early-tokens-acquisition` Requires that all filters which use 'OidcClient' acquire the tokens at the post-construct initialization time, possibly long before these tokens are used. This property should be disabled if the access token may expire before it is used for the first time and no refresh token is available. Environment variable: `QUARKUS_OIDC_CLIENT_EARLY_TOKENS_ACQUISITION` Show more	boolean	`true`
`quarkus.oidc-client.credentials.jwt.claims` Additional claims. Environment variable: `QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_CLAIMS` Show more	`Map<String,String>`
`quarkus.oidc-client.grant-options` Grant options Environment variable: `QUARKUS_OIDC_CLIENT_GRANT_OPTIONS` Show more	`Map<String,Map<String,String>>`
`quarkus.oidc-client.headers` Custom HTTP headers which have to be sent to the token endpoint Environment variable: `QUARKUS_OIDC_CLIENT_HEADERS` Show more	`Map<String,String>`
Additional named clients	Tipo	Por defecto
`quarkus.oidc-client."id".auth-server-url` The base URL of the OpenID Connect (OIDC) server, for example, `https://host:port/auth`. Do not set this property if the public key verification (`public-key`) or certificate chain verification only (`certificate-chain`) is required. The OIDC discovery endpoint is called by default by appending a `.well-known/openid-configuration` path to this URL. For Keycloak, use `https://host:port/realms/{realm}`, replacing `{realm}` with the Keycloak realm name. Environment variable: `QUARKUS_OIDC_CLIENT__ID__AUTH_SERVER_URL` Show more	string
`quarkus.oidc-client."id".discovery-enabled` Discovery of the OIDC endpoints. If not enabled, you must configure the OIDC endpoint URLs individually. Environment variable: `QUARKUS_OIDC_CLIENT__ID__DISCOVERY_ENABLED` Show more	boolean	`true`
`quarkus.oidc-client."id".token-path` The OIDC token endpoint that issues access and refresh tokens; specified as a relative path or absolute URL. Set if `discovery-enabled` is `false` or a discovered token endpoint path must be customized. Environment variable: `QUARKUS_OIDC_CLIENT__ID__TOKEN_PATH` Show more	string
`quarkus.oidc-client."id".revoke-path` The relative path or absolute URL of the OIDC token revocation endpoint. Environment variable: `QUARKUS_OIDC_CLIENT__ID__REVOKE_PATH` Show more	string
`quarkus.oidc-client."id".client-id` The client id of the application. Each application has a client id that is used to identify the application. Setting the client id is not required if `application-type` is `service` and no token introspection is required. Environment variable: `QUARKUS_OIDC_CLIENT__ID__CLIENT_ID` Show more	string
`quarkus.oidc-client."id".connection-delay` The duration to attempt the initial connection to an OIDC server. For example, setting the duration to `20S` allows 10 retries, each 2 seconds apart. This property is only effective when the initial OIDC connection is created. For dropped connections, use the `connection-retry-count` property instead. Environment variable: `QUARKUS_OIDC_CLIENT__ID__CONNECTION_DELAY` Show more	Duration
`quarkus.oidc-client."id".connection-retry-count` The number of times to retry re-establishing an existing OIDC connection if it is temporarily lost. Different from `connection-delay`, which applies only to initial connection attempts. For instance, if a request to the OIDC token endpoint fails due to a connection issue, it will be retried as per this setting. Environment variable: `QUARKUS_OIDC_CLIENT__ID__CONNECTION_RETRY_COUNT` Show more	int	`3`
`quarkus.oidc-client."id".connection-timeout` The number of seconds after which the current OIDC connection request times out. Environment variable: `QUARKUS_OIDC_CLIENT__ID__CONNECTION_TIMEOUT` Show more	Duration	`10S`
`quarkus.oidc-client."id".use-blocking-dns-lookup` Whether DNS lookup should be performed on the worker thread. Use this option when you can see logged warnings about blocked Vert.x event loop by HTTP requests to OIDC server. Environment variable: `QUARKUS_OIDC_CLIENT__ID__USE_BLOCKING_DNS_LOOKUP` Show more	boolean	`false`
`quarkus.oidc-client."id".max-pool-size` The maximum size of the connection pool used by the WebClient. Environment variable: `QUARKUS_OIDC_CLIENT__ID__MAX_POOL_SIZE` Show more	int
`quarkus.oidc-client."id".credentials.secret` The client secret used by the `client_secret_basic` authentication method. Must be set unless a secret is set in `client-secret` or `jwt` client authentication is required. You can use `client-secret.value` instead, but both properties are mutually exclusive. Environment variable: `QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_SECRET` Show more	string
`quarkus.oidc-client."id".credentials.client-secret.value` The client secret value. This value is ignored if `credentials.secret` is set. Must be set unless a secret is set in `client-secret` or `jwt` client authentication is required. Environment variable: `QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_CLIENT_SECRET_VALUE` Show more	string
`quarkus.oidc-client."id".credentials.client-secret.provider.name` The CredentialsProvider name, which should only be set if more than one CredentialsProvider is registered Environment variable: `QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_CLIENT_SECRET_PROVIDER_NAME` Show more	string
`quarkus.oidc-client."id".credentials.client-secret.provider.key` The CredentialsProvider client secret key Environment variable: `QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_CLIENT_SECRET_PROVIDER_KEY` Show more	string
`quarkus.oidc-client."id".credentials.client-secret.method` The authentication method. If the `clientSecret.value` secret is set, this method is `basic` by default. Environment variable: `QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_CLIENT_SECRET_METHOD` Show more	`basicclient_secret_basic` (default): The client id and secret are submitted with the HTTP Authorization Basic scheme., `postclient_secret_post`: The client id and secret are submitted as the `client_id` and `client_secret` form parameters., `post-jwtclient_secret_jwt`: The client id and generated JWT secret are submitted as the `client_id` and `client_secret` form parameters., `query`client id and secret are submitted as HTTP query parameters. This option is only supported by the OIDC extension.
`quarkus.oidc-client."id".credentials.jwt.source` JWT token source: OIDC provider client or an existing JWT bearer token. Environment variable: `QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_SOURCE` Show more	`client`, `bearer`	`client`
`quarkus.oidc-client."id".credentials.jwt.secret` If provided, indicates that JWT is signed using a secret key. Environment variable: `QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_SECRET` Show more	string
`quarkus.oidc-client."id".credentials.jwt.secret-provider.name` The CredentialsProvider name, which should only be set if more than one CredentialsProvider is registered Environment variable: `QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_SECRET_PROVIDER_NAME` Show more	string
`quarkus.oidc-client."id".credentials.jwt.secret-provider.key` The CredentialsProvider client secret key Environment variable: `QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_SECRET_PROVIDER_KEY` Show more	string
`quarkus.oidc-client."id".credentials.jwt.key-file` If provided, indicates that JWT is signed using a private key in PEM or JWK format. You can use the `signature-algorithm` property to override the default key algorithm, `RS256`. Environment variable: `QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_KEY_FILE` Show more	string
`quarkus.oidc-client."id".credentials.jwt.key-store-file` If provided, indicates that JWT is signed using a private key from a keystore. Environment variable: `QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_KEY_STORE_FILE` Show more	string
`quarkus.oidc-client."id".credentials.jwt.key-store-password` A parameter to specify the password of the keystore file. Environment variable: `QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_KEY_STORE_PASSWORD` Show more	string
`quarkus.oidc-client."id".credentials.jwt.key-id` The private key id or alias. Environment variable: `QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_KEY_ID` Show more	string
`quarkus.oidc-client."id".credentials.jwt.key-password` The private key password. Environment variable: `QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_KEY_PASSWORD` Show more	string
`quarkus.oidc-client."id".credentials.jwt.audience` The JWT audience (`aud`) claim value. By default, the audience is set to the address of the OpenId Connect Provider’s token endpoint. Environment variable: `QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_AUDIENCE` Show more	string
`quarkus.oidc-client."id".credentials.jwt.token-key-id` The key identifier of the signing key added as a JWT `kid` header. Environment variable: `QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_TOKEN_KEY_ID` Show more	string
`quarkus.oidc-client."id".credentials.jwt.issuer` The issuer of the signing key added as a JWT `iss` claim. The default value is the client id. Environment variable: `QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_ISSUER` Show more	string
`quarkus.oidc-client."id".credentials.jwt.subject` Subject of the signing key added as a JWT `sub` claim The default value is the client id. Environment variable: `QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_SUBJECT` Show more	string
`quarkus.oidc-client."id".credentials.jwt.claims` Additional claims. Environment variable: `QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_CLAIMS` Show more	`Map<String,String>`
`quarkus.oidc-client."id".credentials.jwt.signature-algorithm` The signature algorithm used for the `key-file` property. Supported values: `RS256` (default), `RS384`, `RS512`, `PS256`, `PS384`, `PS512`, `ES256`, `ES384`, `ES512`, `HS256`, `HS384`, `HS512`. Environment variable: `QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_SIGNATURE_ALGORITHM` Show more	string
`quarkus.oidc-client."id".credentials.jwt.lifespan` The JWT lifespan in seconds. This value is added to the time at which the JWT was issued to calculate the expiration time. Environment variable: `QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_LIFESPAN` Show more	int	`10`
`quarkus.oidc-client."id".proxy.host` The host name or IP address of the Proxy. Note: If the OIDC adapter requires a Proxy to talk with the OIDC server (Provider), set this value to enable the usage of a Proxy. Environment variable: `QUARKUS_OIDC_CLIENT__ID__PROXY_HOST` Show more	string
`quarkus.oidc-client."id".proxy.port` The port number of the Proxy. The default value is `80`. Environment variable: `QUARKUS_OIDC_CLIENT__ID__PROXY_PORT` Show more	int	`80`
`quarkus.oidc-client."id".proxy.username` The username, if the Proxy needs authentication. Environment variable: `QUARKUS_OIDC_CLIENT__ID__PROXY_USERNAME` Show more	string
`quarkus.oidc-client."id".proxy.password` The password, if the Proxy needs authentication. Environment variable: `QUARKUS_OIDC_CLIENT__ID__PROXY_PASSWORD` Show more	string
`quarkus.oidc-client."id".tls.verification` Certificate validation and hostname verification, which can be one of the following `Verification` values. Default is `required`. Environment variable: `QUARKUS_OIDC_CLIENT__ID__TLS_VERIFICATION` Show more	`required`Certificates are validated and hostname verification is enabled. This is the default value., `certificate-validation`Certificates are validated but hostname verification is disabled., `none`All certificates are trusted and hostname verification is disabled.
`quarkus.oidc-client."id".tls.key-store-file` An optional keystore that holds the certificate information instead of specifying separate files. Environment variable: `QUARKUS_OIDC_CLIENT__ID__TLS_KEY_STORE_FILE` Show more	path
`quarkus.oidc-client."id".tls.key-store-file-type` The type of the keystore file. If not given, the type is automatically detected based on the file name. Environment variable: `QUARKUS_OIDC_CLIENT__ID__TLS_KEY_STORE_FILE_TYPE` Show more	string
`quarkus.oidc-client."id".tls.key-store-provider` The provider of the keystore file. If not given, the provider is automatically detected based on the keystore file type. Environment variable: `QUARKUS_OIDC_CLIENT__ID__TLS_KEY_STORE_PROVIDER` Show more	string
`quarkus.oidc-client."id".tls.key-store-password` The password of the keystore file. If not given, the default value, `password`, is used. Environment variable: `QUARKUS_OIDC_CLIENT__ID__TLS_KEY_STORE_PASSWORD` Show more	string
`quarkus.oidc-client."id".tls.key-store-key-alias` The alias of a specific key in the keystore. When SNI is disabled, if the keystore contains multiple keys and no alias is specified, the behavior is undefined. Environment variable: `QUARKUS_OIDC_CLIENT__ID__TLS_KEY_STORE_KEY_ALIAS` Show more	string
`quarkus.oidc-client."id".tls.key-store-key-password` The password of the key, if it is different from the `key-store-password`. Environment variable: `QUARKUS_OIDC_CLIENT__ID__TLS_KEY_STORE_KEY_PASSWORD` Show more	string
`quarkus.oidc-client."id".tls.trust-store-file` The truststore that holds the certificate information of the certificates to trust. Environment variable: `QUARKUS_OIDC_CLIENT__ID__TLS_TRUST_STORE_FILE` Show more	path
`quarkus.oidc-client."id".tls.trust-store-password` The password of the truststore file. Environment variable: `QUARKUS_OIDC_CLIENT__ID__TLS_TRUST_STORE_PASSWORD` Show more	string
`quarkus.oidc-client."id".tls.trust-store-cert-alias` The alias of the truststore certificate. Environment variable: `QUARKUS_OIDC_CLIENT__ID__TLS_TRUST_STORE_CERT_ALIAS` Show more	string
`quarkus.oidc-client."id".tls.trust-store-file-type` The type of the truststore file. If not given, the type is automatically detected based on the file name. Environment variable: `QUARKUS_OIDC_CLIENT__ID__TLS_TRUST_STORE_FILE_TYPE` Show more	string
`quarkus.oidc-client."id".tls.trust-store-provider` The provider of the truststore file. If not given, the provider is automatically detected based on the truststore file type. Environment variable: `QUARKUS_OIDC_CLIENT__ID__TLS_TRUST_STORE_PROVIDER` Show more	string
`quarkus.oidc-client."id".id` A unique OIDC client identifier. It must be set when OIDC clients are created dynamically and is optional in all other cases. Environment variable: `QUARKUS_OIDC_CLIENT__ID__ID` Show more	string
`quarkus.oidc-client."id".client-enabled` If this client configuration is enabled. Environment variable: `QUARKUS_OIDC_CLIENT__ID__CLIENT_ENABLED` Show more	boolean	`true`
`quarkus.oidc-client."id".scopes` List of access token scopes Environment variable: `QUARKUS_OIDC_CLIENT__ID__SCOPES` Show more	list of string
`quarkus.oidc-client."id".refresh-token-time-skew` Refresh token time skew in seconds. If this property is enabled then the configured number of seconds is added to the current time when checking whether the access token should be refreshed. If the sum is greater than this access token’s expiration time then a refresh is going to happen. Environment variable: `QUARKUS_OIDC_CLIENT__ID__REFRESH_TOKEN_TIME_SKEW` Show more	Duration
`quarkus.oidc-client."id".absolute-expires-in` If the access token 'expires_in' property should be checked as an absolute time value as opposed to a duration relative to the current time. Environment variable: `QUARKUS_OIDC_CLIENT__ID__ABSOLUTE_EXPIRES_IN` Show more	boolean	`false`
`quarkus.oidc-client."id".grant.type` Grant type Environment variable: `QUARKUS_OIDC_CLIENT__ID__GRANT_TYPE` Show more	`client`'client_credentials' grant requiring an OIDC client authentication only, `password`'password' grant requiring both OIDC client and user ('username' and 'password') authentications, `code`'authorization_code' grant requiring an OIDC client authentication as well as at least 'code' and 'redirect_uri' parameters which must be passed to OidcClient at the token request time., `exchange`'urn:ietf:params:oauth:grant-type:token-exchange' grant requiring an OIDC client authentication as well as at least 'subject_token' parameter which must be passed to OidcClient at the token request time., `jwt`'urn:ietf:params:oauth:grant-type:jwt-bearer' grant requiring an OIDC client authentication as well as at least an 'assertion' parameter which must be passed to OidcClient at the token request time., `refresh`'refresh_token' grant requiring an OIDC client authentication and a refresh token. Note, OidcClient supports this grant by default if an access token acquisition response contained a refresh token. However, in some cases, the refresh token is provided out of band, for example, it can be shared between several of the confidential client’s services, etc. If 'quarkus.oidc-client.grant-type' is set to 'refresh' then `OidcClient` will only support refreshing the tokens., `ciba`'urn:openid:params:grant-type:ciba' grant requiring an OIDC client authentication as well as 'auth_req_id' parameter which must be passed to OidcClient at the token request time., `device`'urn:ietf:params:oauth:grant-type:device_code' grant requiring an OIDC client authentication as well as 'device_code' parameter which must be passed to OidcClient at the token request time.	`client`
`quarkus.oidc-client."id".grant.access-token-property` Access token property name in a token grant response Environment variable: `QUARKUS_OIDC_CLIENT__ID__GRANT_ACCESS_TOKEN_PROPERTY` Show more	string	`access_token`
`quarkus.oidc-client."id".grant.refresh-token-property` Refresh token property name in a token grant response Environment variable: `QUARKUS_OIDC_CLIENT__ID__GRANT_REFRESH_TOKEN_PROPERTY` Show more	string	`refresh_token`
`quarkus.oidc-client."id".grant.expires-in-property` Access token expiry property name in a token grant response Environment variable: `QUARKUS_OIDC_CLIENT__ID__GRANT_EXPIRES_IN_PROPERTY` Show more	string	`expires_in`
`quarkus.oidc-client."id".grant.refresh-expires-in-property` Refresh token expiry property name in a token grant response Environment variable: `QUARKUS_OIDC_CLIENT__ID__GRANT_REFRESH_EXPIRES_IN_PROPERTY` Show more	string	`refresh_expires_in`
`quarkus.oidc-client."id".grant-options` Grant options Environment variable: `QUARKUS_OIDC_CLIENT__ID__GRANT_OPTIONS` Show more	`Map<String,Map<String,String>>`
`quarkus.oidc-client."id".early-tokens-acquisition` Requires that all filters which use 'OidcClient' acquire the tokens at the post-construct initialization time, possibly long before these tokens are used. This property should be disabled if the access token may expire before it is used for the first time and no refresh token is available. Environment variable: `QUARKUS_OIDC_CLIENT__ID__EARLY_TOKENS_ACQUISITION` Show more	boolean	`true`
`quarkus.oidc-client."id".headers` Custom HTTP headers which have to be sent to the token endpoint Environment variable: `QUARKUS_OIDC_CLIENT__ID__HEADERS` Show more	`Map<String,String>`

Configuration property

Tipo

Por defecto

quarkus.oidc-client.enabled

If the OIDC client extension is enabled.

Environment variable: QUARKUS_OIDC_CLIENT_ENABLED

boolean

true

quarkus.oidc-client.auth-server-url

The base URL of the OpenID Connect (OIDC) server, for example, https://host:port/auth. Do not set this property if the public key verification (public-key) or certificate chain verification only (certificate-chain) is required. The OIDC discovery endpoint is called by default by appending a .well-known/openid-configuration path to this URL. For Keycloak, use https://host:port/realms/{realm}, replacing {realm} with the Keycloak realm name.

Environment variable: QUARKUS_OIDC_CLIENT_AUTH_SERVER_URL

string

quarkus.oidc-client.discovery-enabled

Discovery of the OIDC endpoints. If not enabled, you must configure the OIDC endpoint URLs individually.

Environment variable: QUARKUS_OIDC_CLIENT_DISCOVERY_ENABLED

boolean

true

quarkus.oidc-client.token-path

The OIDC token endpoint that issues access and refresh tokens; specified as a relative path or absolute URL. Set if discovery-enabled is false or a discovered token endpoint path must be customized.

Environment variable: QUARKUS_OIDC_CLIENT_TOKEN_PATH

string

quarkus.oidc-client.revoke-path

The relative path or absolute URL of the OIDC token revocation endpoint.

Environment variable: QUARKUS_OIDC_CLIENT_REVOKE_PATH

string

quarkus.oidc-client.client-id

The client id of the application. Each application has a client id that is used to identify the application. Setting the client id is not required if application-type is service and no token introspection is required.

Environment variable: QUARKUS_OIDC_CLIENT_CLIENT_ID

string

quarkus.oidc-client.connection-delay

The duration to attempt the initial connection to an OIDC server. For example, setting the duration to 20S allows 10 retries, each 2 seconds apart. This property is only effective when the initial OIDC connection is created. For dropped connections, use the connection-retry-count property instead.

Environment variable: QUARKUS_OIDC_CLIENT_CONNECTION_DELAY

Duration

quarkus.oidc-client.connection-retry-count

The number of times to retry re-establishing an existing OIDC connection if it is temporarily lost. Different from connection-delay, which applies only to initial connection attempts. For instance, if a request to the OIDC token endpoint fails due to a connection issue, it will be retried as per this setting.

Environment variable: QUARKUS_OIDC_CLIENT_CONNECTION_RETRY_COUNT

int

3

quarkus.oidc-client.connection-timeout

The number of seconds after which the current OIDC connection request times out.

Environment variable: QUARKUS_OIDC_CLIENT_CONNECTION_TIMEOUT

Duration

10S

quarkus.oidc-client.use-blocking-dns-lookup

Whether DNS lookup should be performed on the worker thread. Use this option when you can see logged warnings about blocked Vert.x event loop by HTTP requests to OIDC server.

Environment variable: QUARKUS_OIDC_CLIENT_USE_BLOCKING_DNS_LOOKUP

boolean

false

quarkus.oidc-client.max-pool-size

The maximum size of the connection pool used by the WebClient.

Environment variable: QUARKUS_OIDC_CLIENT_MAX_POOL_SIZE

int

quarkus.oidc-client.credentials.secret

The client secret used by the client_secret_basic authentication method. Must be set unless a secret is set in client-secret or jwt client authentication is required. You can use client-secret.value instead, but both properties are mutually exclusive.

Environment variable: QUARKUS_OIDC_CLIENT_CREDENTIALS_SECRET

string

quarkus.oidc-client.credentials.client-secret.value

The client secret value. This value is ignored if credentials.secret is set. Must be set unless a secret is set in client-secret or jwt client authentication is required.

Environment variable: QUARKUS_OIDC_CLIENT_CREDENTIALS_CLIENT_SECRET_VALUE

string

quarkus.oidc-client.credentials.client-secret.provider.name

The CredentialsProvider name, which should only be set if more than one CredentialsProvider is registered

Environment variable: QUARKUS_OIDC_CLIENT_CREDENTIALS_CLIENT_SECRET_PROVIDER_NAME

string

quarkus.oidc-client.credentials.client-secret.provider.key

The CredentialsProvider client secret key

Environment variable: QUARKUS_OIDC_CLIENT_CREDENTIALS_CLIENT_SECRET_PROVIDER_KEY

string

quarkus.oidc-client.credentials.client-secret.method

The authentication method. If the clientSecret.value secret is set, this method is basic by default.

Environment variable: QUARKUS_OIDC_CLIENT_CREDENTIALS_CLIENT_SECRET_METHOD

basicclient_secret_basic (default): The client id and secret are submitted with the HTTP Authorization Basic scheme., postclient_secret_post: The client id and secret are submitted as the client_id and client_secret form parameters., post-jwtclient_secret_jwt: The client id and generated JWT secret are submitted as the client_id and client_secret form parameters., queryclient id and secret are submitted as HTTP query parameters. This option is only supported by the OIDC extension.

quarkus.oidc-client.credentials.jwt.source

JWT token source: OIDC provider client or an existing JWT bearer token.

Environment variable: QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_SOURCE

client, bearer

client

quarkus.oidc-client.credentials.jwt.secret

If provided, indicates that JWT is signed using a secret key.

Environment variable: QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_SECRET

string

quarkus.oidc-client.credentials.jwt.secret-provider.name

The CredentialsProvider name, which should only be set if more than one CredentialsProvider is registered

Environment variable: QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_SECRET_PROVIDER_NAME

string

quarkus.oidc-client.credentials.jwt.secret-provider.key

The CredentialsProvider client secret key

Environment variable: QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_SECRET_PROVIDER_KEY

string

quarkus.oidc-client.credentials.jwt.key-file

If provided, indicates that JWT is signed using a private key in PEM or JWK format. You can use the signature-algorithm property to override the default key algorithm, RS256.

Environment variable: QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_KEY_FILE

string

quarkus.oidc-client.credentials.jwt.key-store-file

If provided, indicates that JWT is signed using a private key from a keystore.

Environment variable: QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_KEY_STORE_FILE

string

quarkus.oidc-client.credentials.jwt.key-store-password

A parameter to specify the password of the keystore file.

Environment variable: QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_KEY_STORE_PASSWORD

string

quarkus.oidc-client.credentials.jwt.key-id

The private key id or alias.

Environment variable: QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_KEY_ID

string

quarkus.oidc-client.credentials.jwt.key-password

The private key password.

Environment variable: QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_KEY_PASSWORD

string

quarkus.oidc-client.credentials.jwt.audience

The JWT audience (aud) claim value. By default, the audience is set to the address of the OpenId Connect Provider’s token endpoint.

Environment variable: QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_AUDIENCE

string

quarkus.oidc-client.credentials.jwt.token-key-id

The key identifier of the signing key added as a JWT kid header.

Environment variable: QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_TOKEN_KEY_ID

string

quarkus.oidc-client.credentials.jwt.issuer

The issuer of the signing key added as a JWT iss claim. The default value is the client id.

Environment variable: QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_ISSUER

string

quarkus.oidc-client.credentials.jwt.subject

Subject of the signing key added as a JWT sub claim The default value is the client id.

Environment variable: QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_SUBJECT

string

quarkus.oidc-client.credentials.jwt.signature-algorithm

The signature algorithm used for the key-file property. Supported values: RS256 (default), RS384, RS512, PS256, PS384, PS512, ES256, ES384, ES512, HS256, HS384, HS512.

Environment variable: QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_SIGNATURE_ALGORITHM

string

quarkus.oidc-client.credentials.jwt.lifespan

The JWT lifespan in seconds. This value is added to the time at which the JWT was issued to calculate the expiration time.

Environment variable: QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_LIFESPAN

int

10

quarkus.oidc-client.proxy.host

The host name or IP address of the Proxy.
Note: If the OIDC adapter requires a Proxy to talk with the OIDC server (Provider), set this value to enable the usage of a Proxy.

Environment variable: QUARKUS_OIDC_CLIENT_PROXY_HOST

string

quarkus.oidc-client.proxy.port

The port number of the Proxy. The default value is 80.

Environment variable: QUARKUS_OIDC_CLIENT_PROXY_PORT

int

80

quarkus.oidc-client.proxy.username

The username, if the Proxy needs authentication.

Environment variable: QUARKUS_OIDC_CLIENT_PROXY_USERNAME

string

quarkus.oidc-client.proxy.password

The password, if the Proxy needs authentication.

Environment variable: QUARKUS_OIDC_CLIENT_PROXY_PASSWORD

string

quarkus.oidc-client.tls.verification

Certificate validation and hostname verification, which can be one of the following Verification values. Default is required.

Environment variable: QUARKUS_OIDC_CLIENT_TLS_VERIFICATION

requiredCertificates are validated and hostname verification is enabled. This is the default value., certificate-validationCertificates are validated but hostname verification is disabled., noneAll certificates are trusted and hostname verification is disabled.

quarkus.oidc-client.tls.key-store-file

An optional keystore that holds the certificate information instead of specifying separate files.

Environment variable: QUARKUS_OIDC_CLIENT_TLS_KEY_STORE_FILE

path

quarkus.oidc-client.tls.key-store-file-type

The type of the keystore file. If not given, the type is automatically detected based on the file name.

Environment variable: QUARKUS_OIDC_CLIENT_TLS_KEY_STORE_FILE_TYPE

string

quarkus.oidc-client.tls.key-store-provider

The provider of the keystore file. If not given, the provider is automatically detected based on the keystore file type.

Environment variable: QUARKUS_OIDC_CLIENT_TLS_KEY_STORE_PROVIDER

string

quarkus.oidc-client.tls.key-store-password

The password of the keystore file. If not given, the default value, password, is used.

Environment variable: QUARKUS_OIDC_CLIENT_TLS_KEY_STORE_PASSWORD

string

quarkus.oidc-client.tls.key-store-key-alias

The alias of a specific key in the keystore. When SNI is disabled, if the keystore contains multiple keys and no alias is specified, the behavior is undefined.

Environment variable: QUARKUS_OIDC_CLIENT_TLS_KEY_STORE_KEY_ALIAS

string

quarkus.oidc-client.tls.key-store-key-password

The password of the key, if it is different from the key-store-password.

Environment variable: QUARKUS_OIDC_CLIENT_TLS_KEY_STORE_KEY_PASSWORD

string

quarkus.oidc-client.tls.trust-store-file

The truststore that holds the certificate information of the certificates to trust.

Environment variable: QUARKUS_OIDC_CLIENT_TLS_TRUST_STORE_FILE

path

quarkus.oidc-client.tls.trust-store-password

The password of the truststore file.

Environment variable: QUARKUS_OIDC_CLIENT_TLS_TRUST_STORE_PASSWORD

string

quarkus.oidc-client.tls.trust-store-cert-alias

The alias of the truststore certificate.

Environment variable: QUARKUS_OIDC_CLIENT_TLS_TRUST_STORE_CERT_ALIAS

string

quarkus.oidc-client.tls.trust-store-file-type

The type of the truststore file. If not given, the type is automatically detected based on the file name.

Environment variable: QUARKUS_OIDC_CLIENT_TLS_TRUST_STORE_FILE_TYPE

string

quarkus.oidc-client.tls.trust-store-provider

The provider of the truststore file. If not given, the provider is automatically detected based on the truststore file type.

Environment variable: QUARKUS_OIDC_CLIENT_TLS_TRUST_STORE_PROVIDER

string

quarkus.oidc-client.id

A unique OIDC client identifier. It must be set when OIDC clients are created dynamically and is optional in all other cases.

Environment variable: QUARKUS_OIDC_CLIENT_ID

string

quarkus.oidc-client.client-enabled

If this client configuration is enabled.

Environment variable: QUARKUS_OIDC_CLIENT_CLIENT_ENABLED

boolean

true

quarkus.oidc-client.scopes

List of access token scopes

Environment variable: QUARKUS_OIDC_CLIENT_SCOPES

list of string

quarkus.oidc-client.refresh-token-time-skew

Refresh token time skew in seconds. If this property is enabled then the configured number of seconds is added to the current time when checking whether the access token should be refreshed. If the sum is greater than this access token’s expiration time then a refresh is going to happen.

Environment variable: QUARKUS_OIDC_CLIENT_REFRESH_TOKEN_TIME_SKEW

Duration

quarkus.oidc-client.absolute-expires-in

If the access token 'expires_in' property should be checked as an absolute time value as opposed to a duration relative to the current time.

Environment variable: QUARKUS_OIDC_CLIENT_ABSOLUTE_EXPIRES_IN

boolean

false

quarkus.oidc-client.grant.type

Grant type

Environment variable: QUARKUS_OIDC_CLIENT_GRANT_TYPE

client'client_credentials' grant requiring an OIDC client authentication only, password'password' grant requiring both OIDC client and user ('username' and 'password') authentications, code'authorization_code' grant requiring an OIDC client authentication as well as at least 'code' and 'redirect_uri' parameters which must be passed to OidcClient at the token request time., exchange'urn:ietf:params:oauth:grant-type:token-exchange' grant requiring an OIDC client authentication as well as at least 'subject_token' parameter which must be passed to OidcClient at the token request time., jwt'urn:ietf:params:oauth:grant-type:jwt-bearer' grant requiring an OIDC client authentication as well as at least an 'assertion' parameter which must be passed to OidcClient at the token request time., refresh'refresh_token' grant requiring an OIDC client authentication and a refresh token. Note, OidcClient supports this grant by default if an access token acquisition response contained a refresh token. However, in some cases, the refresh token is provided out of band, for example, it can be shared between several of the confidential client’s services, etc. If 'quarkus.oidc-client.grant-type' is set to 'refresh' then OidcClient will only support refreshing the tokens., ciba'urn:openid:params:grant-type:ciba' grant requiring an OIDC client authentication as well as 'auth_req_id' parameter which must be passed to OidcClient at the token request time., device'urn:ietf:params:oauth:grant-type:device_code' grant requiring an OIDC client authentication as well as 'device_code' parameter which must be passed to OidcClient at the token request time.

client

quarkus.oidc-client.grant.access-token-property

Access token property name in a token grant response

Environment variable: QUARKUS_OIDC_CLIENT_GRANT_ACCESS_TOKEN_PROPERTY

string

access_token

quarkus.oidc-client.grant.refresh-token-property

Refresh token property name in a token grant response

Environment variable: QUARKUS_OIDC_CLIENT_GRANT_REFRESH_TOKEN_PROPERTY

string

refresh_token

quarkus.oidc-client.grant.expires-in-property

Access token expiry property name in a token grant response

Environment variable: QUARKUS_OIDC_CLIENT_GRANT_EXPIRES_IN_PROPERTY

string

expires_in

quarkus.oidc-client.grant.refresh-expires-in-property

Refresh token expiry property name in a token grant response

Environment variable: QUARKUS_OIDC_CLIENT_GRANT_REFRESH_EXPIRES_IN_PROPERTY

string

refresh_expires_in

quarkus.oidc-client.early-tokens-acquisition

Requires that all filters which use 'OidcClient' acquire the tokens at the post-construct initialization time, possibly long before these tokens are used. This property should be disabled if the access token may expire before it is used for the first time and no refresh token is available.

Environment variable: QUARKUS_OIDC_CLIENT_EARLY_TOKENS_ACQUISITION

boolean

true

quarkus.oidc-client.credentials.jwt.claims

Additional claims.

Environment variable: QUARKUS_OIDC_CLIENT_CREDENTIALS_JWT_CLAIMS

Map<String,String>

quarkus.oidc-client.grant-options

Grant options

Environment variable: QUARKUS_OIDC_CLIENT_GRANT_OPTIONS

Map<String,Map<String,String>>

quarkus.oidc-client.headers

Custom HTTP headers which have to be sent to the token endpoint

Environment variable: QUARKUS_OIDC_CLIENT_HEADERS

Map<String,String>

Additional named clients

Tipo

Por defecto

quarkus.oidc-client."id".auth-server-url

Environment variable: QUARKUS_OIDC_CLIENT__ID__AUTH_SERVER_URL

string

quarkus.oidc-client."id".discovery-enabled

Discovery of the OIDC endpoints. If not enabled, you must configure the OIDC endpoint URLs individually.

Environment variable: QUARKUS_OIDC_CLIENT__ID__DISCOVERY_ENABLED

boolean

true

quarkus.oidc-client."id".token-path

Environment variable: QUARKUS_OIDC_CLIENT__ID__TOKEN_PATH

string

quarkus.oidc-client."id".revoke-path

The relative path or absolute URL of the OIDC token revocation endpoint.

Environment variable: QUARKUS_OIDC_CLIENT__ID__REVOKE_PATH

string

quarkus.oidc-client."id".client-id

Environment variable: QUARKUS_OIDC_CLIENT__ID__CLIENT_ID

string

quarkus.oidc-client."id".connection-delay

Environment variable: QUARKUS_OIDC_CLIENT__ID__CONNECTION_DELAY

Duration

quarkus.oidc-client."id".connection-retry-count

Environment variable: QUARKUS_OIDC_CLIENT__ID__CONNECTION_RETRY_COUNT

int

3

quarkus.oidc-client."id".connection-timeout

The number of seconds after which the current OIDC connection request times out.

Environment variable: QUARKUS_OIDC_CLIENT__ID__CONNECTION_TIMEOUT

Duration

10S

quarkus.oidc-client."id".use-blocking-dns-lookup

Whether DNS lookup should be performed on the worker thread. Use this option when you can see logged warnings about blocked Vert.x event loop by HTTP requests to OIDC server.

Environment variable: QUARKUS_OIDC_CLIENT__ID__USE_BLOCKING_DNS_LOOKUP

boolean

false

quarkus.oidc-client."id".max-pool-size

The maximum size of the connection pool used by the WebClient.

Environment variable: QUARKUS_OIDC_CLIENT__ID__MAX_POOL_SIZE

int

quarkus.oidc-client."id".credentials.secret

Environment variable: QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_SECRET

string

quarkus.oidc-client."id".credentials.client-secret.value

The client secret value. This value is ignored if credentials.secret is set. Must be set unless a secret is set in client-secret or jwt client authentication is required.

Environment variable: QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_CLIENT_SECRET_VALUE

string

quarkus.oidc-client."id".credentials.client-secret.provider.name

The CredentialsProvider name, which should only be set if more than one CredentialsProvider is registered

Environment variable: QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_CLIENT_SECRET_PROVIDER_NAME

string

quarkus.oidc-client."id".credentials.client-secret.provider.key

The CredentialsProvider client secret key

Environment variable: QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_CLIENT_SECRET_PROVIDER_KEY

string

quarkus.oidc-client."id".credentials.client-secret.method

The authentication method. If the clientSecret.value secret is set, this method is basic by default.

Environment variable: QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_CLIENT_SECRET_METHOD

quarkus.oidc-client."id".credentials.jwt.source

JWT token source: OIDC provider client or an existing JWT bearer token.

Environment variable: QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_SOURCE

client, bearer

client

quarkus.oidc-client."id".credentials.jwt.secret

If provided, indicates that JWT is signed using a secret key.

Environment variable: QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_SECRET

string

quarkus.oidc-client."id".credentials.jwt.secret-provider.name

The CredentialsProvider name, which should only be set if more than one CredentialsProvider is registered

Environment variable: QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_SECRET_PROVIDER_NAME

string

quarkus.oidc-client."id".credentials.jwt.secret-provider.key

The CredentialsProvider client secret key

Environment variable: QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_SECRET_PROVIDER_KEY

string

quarkus.oidc-client."id".credentials.jwt.key-file

If provided, indicates that JWT is signed using a private key in PEM or JWK format. You can use the signature-algorithm property to override the default key algorithm, RS256.

Environment variable: QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_KEY_FILE

string

quarkus.oidc-client."id".credentials.jwt.key-store-file

If provided, indicates that JWT is signed using a private key from a keystore.

Environment variable: QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_KEY_STORE_FILE

string

quarkus.oidc-client."id".credentials.jwt.key-store-password

A parameter to specify the password of the keystore file.

Environment variable: QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_KEY_STORE_PASSWORD

string

quarkus.oidc-client."id".credentials.jwt.key-id

The private key id or alias.

Environment variable: QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_KEY_ID

string

quarkus.oidc-client."id".credentials.jwt.key-password

The private key password.

Environment variable: QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_KEY_PASSWORD

string

quarkus.oidc-client."id".credentials.jwt.audience

The JWT audience (aud) claim value. By default, the audience is set to the address of the OpenId Connect Provider’s token endpoint.

Environment variable: QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_AUDIENCE

string

quarkus.oidc-client."id".credentials.jwt.token-key-id

The key identifier of the signing key added as a JWT kid header.

Environment variable: QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_TOKEN_KEY_ID

string

quarkus.oidc-client."id".credentials.jwt.issuer

The issuer of the signing key added as a JWT iss claim. The default value is the client id.

Environment variable: QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_ISSUER

string

quarkus.oidc-client."id".credentials.jwt.subject

Subject of the signing key added as a JWT sub claim The default value is the client id.

Environment variable: QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_SUBJECT

string

quarkus.oidc-client."id".credentials.jwt.claims

Additional claims.

Environment variable: QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_CLAIMS

Map<String,String>

quarkus.oidc-client."id".credentials.jwt.signature-algorithm

The signature algorithm used for the key-file property. Supported values: RS256 (default), RS384, RS512, PS256, PS384, PS512, ES256, ES384, ES512, HS256, HS384, HS512.

Environment variable: QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_SIGNATURE_ALGORITHM

string

quarkus.oidc-client."id".credentials.jwt.lifespan

The JWT lifespan in seconds. This value is added to the time at which the JWT was issued to calculate the expiration time.

Environment variable: QUARKUS_OIDC_CLIENT__ID__CREDENTIALS_JWT_LIFESPAN

int

10

quarkus.oidc-client."id".proxy.host

The host name or IP address of the Proxy.
Note: If the OIDC adapter requires a Proxy to talk with the OIDC server (Provider), set this value to enable the usage of a Proxy.

Environment variable: QUARKUS_OIDC_CLIENT__ID__PROXY_HOST

string

quarkus.oidc-client."id".proxy.port

The port number of the Proxy. The default value is 80.

Environment variable: QUARKUS_OIDC_CLIENT__ID__PROXY_PORT

int

80

quarkus.oidc-client."id".proxy.username

The username, if the Proxy needs authentication.

Environment variable: QUARKUS_OIDC_CLIENT__ID__PROXY_USERNAME

string

quarkus.oidc-client."id".proxy.password

The password, if the Proxy needs authentication.

Environment variable: QUARKUS_OIDC_CLIENT__ID__PROXY_PASSWORD

string

quarkus.oidc-client."id".tls.verification

Certificate validation and hostname verification, which can be one of the following Verification values. Default is required.

Environment variable: QUARKUS_OIDC_CLIENT__ID__TLS_VERIFICATION

quarkus.oidc-client."id".tls.key-store-file

An optional keystore that holds the certificate information instead of specifying separate files.

Environment variable: QUARKUS_OIDC_CLIENT__ID__TLS_KEY_STORE_FILE

path

quarkus.oidc-client."id".tls.key-store-file-type

The type of the keystore file. If not given, the type is automatically detected based on the file name.

Environment variable: QUARKUS_OIDC_CLIENT__ID__TLS_KEY_STORE_FILE_TYPE

string

quarkus.oidc-client."id".tls.key-store-provider

The provider of the keystore file. If not given, the provider is automatically detected based on the keystore file type.

Environment variable: QUARKUS_OIDC_CLIENT__ID__TLS_KEY_STORE_PROVIDER

string

quarkus.oidc-client."id".tls.key-store-password

The password of the keystore file. If not given, the default value, password, is used.

Environment variable: QUARKUS_OIDC_CLIENT__ID__TLS_KEY_STORE_PASSWORD

string

quarkus.oidc-client."id".tls.key-store-key-alias

The alias of a specific key in the keystore. When SNI is disabled, if the keystore contains multiple keys and no alias is specified, the behavior is undefined.

Environment variable: QUARKUS_OIDC_CLIENT__ID__TLS_KEY_STORE_KEY_ALIAS

string

quarkus.oidc-client."id".tls.key-store-key-password

The password of the key, if it is different from the key-store-password.

Environment variable: QUARKUS_OIDC_CLIENT__ID__TLS_KEY_STORE_KEY_PASSWORD

string

quarkus.oidc-client."id".tls.trust-store-file

The truststore that holds the certificate information of the certificates to trust.

Environment variable: QUARKUS_OIDC_CLIENT__ID__TLS_TRUST_STORE_FILE

path

quarkus.oidc-client."id".tls.trust-store-password

The password of the truststore file.

Environment variable: QUARKUS_OIDC_CLIENT__ID__TLS_TRUST_STORE_PASSWORD

string

quarkus.oidc-client."id".tls.trust-store-cert-alias

The alias of the truststore certificate.

Environment variable: QUARKUS_OIDC_CLIENT__ID__TLS_TRUST_STORE_CERT_ALIAS

string

quarkus.oidc-client."id".tls.trust-store-file-type

The type of the truststore file. If not given, the type is automatically detected based on the file name.

Environment variable: QUARKUS_OIDC_CLIENT__ID__TLS_TRUST_STORE_FILE_TYPE

string

quarkus.oidc-client."id".tls.trust-store-provider

The provider of the truststore file. If not given, the provider is automatically detected based on the truststore file type.

Environment variable: QUARKUS_OIDC_CLIENT__ID__TLS_TRUST_STORE_PROVIDER

string

quarkus.oidc-client."id".id

A unique OIDC client identifier. It must be set when OIDC clients are created dynamically and is optional in all other cases.

Environment variable: QUARKUS_OIDC_CLIENT__ID__ID

string

quarkus.oidc-client."id".client-enabled

If this client configuration is enabled.

Environment variable: QUARKUS_OIDC_CLIENT__ID__CLIENT_ENABLED

boolean

true

quarkus.oidc-client."id".scopes

List of access token scopes

Environment variable: QUARKUS_OIDC_CLIENT__ID__SCOPES

list of string

quarkus.oidc-client."id".refresh-token-time-skew

Environment variable: QUARKUS_OIDC_CLIENT__ID__REFRESH_TOKEN_TIME_SKEW

Duration

quarkus.oidc-client."id".absolute-expires-in

If the access token 'expires_in' property should be checked as an absolute time value as opposed to a duration relative to the current time.

Environment variable: QUARKUS_OIDC_CLIENT__ID__ABSOLUTE_EXPIRES_IN

boolean

false

quarkus.oidc-client."id".grant.type

Grant type

Environment variable: QUARKUS_OIDC_CLIENT__ID__GRANT_TYPE

client

quarkus.oidc-client."id".grant.access-token-property

Access token property name in a token grant response

Environment variable: QUARKUS_OIDC_CLIENT__ID__GRANT_ACCESS_TOKEN_PROPERTY

string

access_token

quarkus.oidc-client."id".grant.refresh-token-property

Refresh token property name in a token grant response

Environment variable: QUARKUS_OIDC_CLIENT__ID__GRANT_REFRESH_TOKEN_PROPERTY

string

refresh_token

quarkus.oidc-client."id".grant.expires-in-property

Access token expiry property name in a token grant response

Environment variable: QUARKUS_OIDC_CLIENT__ID__GRANT_EXPIRES_IN_PROPERTY

string

expires_in

quarkus.oidc-client."id".grant.refresh-expires-in-property

Refresh token expiry property name in a token grant response

Environment variable: QUARKUS_OIDC_CLIENT__ID__GRANT_REFRESH_EXPIRES_IN_PROPERTY

string

refresh_expires_in

quarkus.oidc-client."id".grant-options

Grant options

Environment variable: QUARKUS_OIDC_CLIENT__ID__GRANT_OPTIONS

Map<String,Map<String,String>>

quarkus.oidc-client."id".early-tokens-acquisition

Environment variable: QUARKUS_OIDC_CLIENT__ID__EARLY_TOKENS_ACQUISITION

boolean

true

quarkus.oidc-client."id".headers

Custom HTTP headers which have to be sent to the token endpoint

Environment variable: QUARKUS_OIDC_CLIENT__ID__HEADERS

Map<String,String>

About the Duration format

To write duration values, use the standard java.time.Duration format. See the Duration#parse() Java API documentation for more information.

You can also use a simplified format, starting with a number:

If the value is only a number, it represents time in seconds.
If the value is a number followed by ms, it represents time in milliseconds.

In other cases, the simplified format is translated to the java.time.Duration format for parsing:

If the value is a number followed by h, m, or s, it is prefixed with PT.
If the value is a number followed by d, it is prefixed with P.

OIDC token propagation

Configuration property fixed at build time - All other configuration properties are overridable at runtime

Configuration property	Tipo	Por defecto
`quarkus.rest-client-oidc-token-propagation.enabled` If the OIDC Token Reactive Propagation is enabled. Environment variable: `QUARKUS_REST_CLIENT_OIDC_TOKEN_PROPAGATION_ENABLED` Show more	boolean	`true`
`quarkus.rest-client-oidc-token-propagation.enabled-during-authentication` Whether the token propagation is enabled during the `SecurityIdentity` augmentation. For example, you may need to use a REST client from `SecurityIdentityAugmentor` to propagate the current token to acquire additional roles for the `SecurityIdentity`. Note, this feature relies on a duplicated context. More information about Vert.x duplicated context can be found in this guide. Environment variable: `QUARKUS_REST_CLIENT_OIDC_TOKEN_PROPAGATION_ENABLED_DURING_AUTHENTICATION` Show more	boolean	`false`
`quarkus.rest-client-oidc-token-propagation.exchange-token` Exchange the current token with OpenId Connect Provider for a new token using either "urn:ietf:params:oauth:grant-type:token-exchange" or "urn:ietf:params:oauth:grant-type:jwt-bearer" token grant before propagating it. Environment variable: `QUARKUS_REST_CLIENT_OIDC_TOKEN_PROPAGATION_EXCHANGE_TOKEN` Show more	boolean	`false`
`quarkus.rest-client-oidc-token-propagation.client-name` Name of the configured OidcClient. Note this property is only used if the `exchangeToken` property is enabled. Environment variable: `QUARKUS_REST_CLIENT_OIDC_TOKEN_PROPAGATION_CLIENT_NAME` Show more	string

Configuration property

Tipo

Por defecto

quarkus.rest-client-oidc-token-propagation.enabled

If the OIDC Token Reactive Propagation is enabled.

Environment variable: QUARKUS_REST_CLIENT_OIDC_TOKEN_PROPAGATION_ENABLED

boolean

true

quarkus.rest-client-oidc-token-propagation.enabled-during-authentication

Whether the token propagation is enabled during the SecurityIdentity augmentation.

For example, you may need to use a REST client from SecurityIdentityAugmentor to propagate the current token to acquire additional roles for the SecurityIdentity.

Note, this feature relies on a duplicated context. More information about Vert.x duplicated context can be found in this guide.

Environment variable: QUARKUS_REST_CLIENT_OIDC_TOKEN_PROPAGATION_ENABLED_DURING_AUTHENTICATION

boolean

false

quarkus.rest-client-oidc-token-propagation.exchange-token

Exchange the current token with OpenId Connect Provider for a new token using either "urn:ietf:params:oauth:grant-type:token-exchange" or "urn:ietf:params:oauth:grant-type:jwt-bearer" token grant before propagating it.

Environment variable: QUARKUS_REST_CLIENT_OIDC_TOKEN_PROPAGATION_EXCHANGE_TOKEN

boolean

false

quarkus.rest-client-oidc-token-propagation.client-name

Name of the configured OidcClient. Note this property is only used if the exchangeToken property is enabled.

Environment variable: QUARKUS_REST_CLIENT_OIDC_TOKEN_PROPAGATION_CLIENT_NAME

string

OpenID Connect (OIDC) and OAuth2 client and filters

OidcClient

Token endpoint configuration

Supported token grants

Client credentials grant

Password grant

Other grants

Grant scopes

Use OidcClient directly

Inject tokens

Use OidcClients

Inject named OidcClient and tokens

Use OidcClient in RestClient Reactive ClientFilter

Use OidcClient in RestClient ClientFilter

Use a custom RestClient ClientFilter

Refreshing access tokens

Revoking access tokens

OidcClient authentication

Additional JWT authentication options

JWT Bearer

Apple POST JWT

Mutual TLS

Probando

Wiremock

Keycloak

How to check the errors in the logs

OIDC request filters

Token Propagation Reactive

Token Propagation

RestClient AccessTokenRequestFilter

Exchange token before propagation

RestClient JsonWebTokenRequestFilter

Update token before propagation

Probando

Token Propagation Reactive

GraphQL client integration

Referencia de configuración

OIDC client

OIDC token propagation

Referencias