Securing Quarkus Backends with Keycloak

services:
  db:
    container_name: postgres
    image: postgres:17.4-alpine3.21
    restart: unless-stopped
    environment:
      POSTGRES_USER: app
      POSTGRES_PASSWORD: app
      POSTGRES_MULTIPLE_DATABASES: keycloak,db
    ports:
      - 5432:5432
    volumes:
      - ./db-postgres/db:/var/lib/postgresql/data
      - ./db-postgres/import:/import
      - ./pg-init-scripts:/docker-entrypoint-initdb.d
  keycloak:
    depends_on:
      - db
    container_name: keycloak
    image: quay.io/keycloak/keycloak:26.1
    restart: no
    environment:
      - KEYCLOAK_ADMIN=admin
      - KEYCLOAK_ADMIN_PASSWORD=password
      - KC_DB=postgres
      - KC_DB_URL=jdbc:postgresql://db:5432/keycloak
      - KC_DB_USERNAME=app
      - KC_DB_PASSWORD=app
    command:
      - start-dev
    ports:
      - 8000:8080

#!/bin/bash

set -e
set -u

function create_user_and_database() {
  local database=$1
  echo "  Creating user and database '$database'"
  psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" <<-EOSQL
      CREATE USER $database;
      CREATE DATABASE $database;
      GRANT ALL PRIVILEGES ON DATABASE $database TO $database;
EOSQL
}

if [ -n "$POSTGRES_MULTIPLE_DATABASES" ]; then
  echo "Multiple database creation requested: $POSTGRES_MULTIPLE_DATABASES"
  for db in $(echo $POSTGRES_MULTIPLE_DATABASES | tr ',' ' '); do
    create_user_and_database $db
  done
  echo "Multiple databases created"
fi

docker compose up

mvn io.quarkus.platform:quarkus-maven-plugin:3.21.0:create \
    -DprojectGroupId=at.htl \
    -DprojectArtifactId=backend-rbac \
    -Dextensions='rest-jackson,oidc,hibernate-orm-panache,jdbc-postgresql,keycloak-authorization'
cd backend-rbac

#### datasource configuration ####(1)
quarkus.datasource.db-kind=postgresql
quarkus.datasource.username=app
quarkus.datasource.password=app
quarkus.datasource.jdbc.url=jdbc:postgresql://localhost:5432/db

#### hibernate configuration ####
quarkus.hibernate-orm.database.generation=drop-and-create
(2)
quarkus.hibernate-orm.physical-naming-strategy=org.hibernate.boot.model.naming.CamelCaseToUnderscoresNamingStrategy

#### keycloak configuration ####
(3)
quarkus.oidc.auth-server-url=http://localhost:8000/realms/demo
(4)
quarkus.oidc.client-id=backend
(5)
quarkus.oidc.credentials.secret=9xCZUZAkn4XPcraKU2vIGg3qiiJ2ieCa

#### other ####
(6)
quarkus.devservices.enabled=false

package at.htl.feature.vehicle;

import jakarta.annotation.security.RolesAllowed;
import jakarta.inject.Inject;
import jakarta.ws.rs.GET;
import jakarta.ws.rs.Path;
import jakarta.ws.rs.PathParam;

import java.util.List;

@Path("/vehicle/")
public class VehicleResource {
    @Inject
    VehicleRepository vehicleRepository;

    @GET
    @RolesAllowed("admin") (1)
    public List<Vehicle> all() {
        return vehicleRepository.listAll();
    }

    @GET
    @Path("/{id}")
    @RolesAllowed("user") (2)
    public Vehicle byId(@PathParam("id") long id) {
        return vehicleRepository
                .findById(id);
    }
}

mvn clean quarkus:dev

#!/usr/bin/bash

set -e

kc_url="http://localhost:8000"
backend_url="http://localhost:8080"
client_id="frontend"
normal_user="jane"
admin_user="john"
password="password"


cmd_resp=""
function show_cmd() {
   echo $ $@
   cmd_resp=$(eval "$@")
}

echo Querying jwt token endpoint...
show_cmd "curl --silent $kc_url/realms/demo/.well-known/openid-configuration | jq -r '.token_endpoint'"
tok_url=$cmd_resp
echo Found token endpoint at: $tok_url

echo -e "\nRequesting access token for normal user..."
show_cmd "curl --silent -d 'client_id=$client_id' -d 'username=$admin_user' -d 'password=$password' -d 'grant_type=password' $tok_url | jq -r '.access_token'"
token=$cmd_resp

echo -e "\nRequesting all vehicles"
echo "$ curl -H 'Authorization: Bearer ...' $backend_url/vehicle/"
curl -H "Authorization: Bearer $token" $backend_url/vehicle/
echo

echo -e "\nRequesting vehicle id=1"
echo "$ curl -H 'Authorization: Bearer ...' $backend_url/vehicle/1"
curl -H "Authorization: Bearer $token" $backend_url/vehicle/1
echo

Querying jwt token endpoint...
$ curl --silent http://localhost:8000/realms/demo/.well-known/openid-configuration | jq -r '.token_endpoint'
Found token endpoint at: http://localhost:8000/realms/demo/protocol/openid-connect/token

Requesting access token for normal user...
$ curl --silent -d 'client_id=frontend' -d 'username=john' -d 'password=password' -d 'grant_type=password' http://localhost:8000/realms/demo/protocol/openid-connect/token | jq -r '.access_token'

Requesting all vehicles
$ curl -H 'Authorization: Bearer ...' http://localhost:8080/vehicle/
[{"id":1,"make":"Honda","model":"Civic","year":1990},{"id":2,"make":"Renault","model":"Clio","year":2001},{"id":3,"make":"BMW","model":"x5","year":2003}]

Requesting vehicle id=1
$ curl -H 'Authorization: Bearer ...' http://localhost:8080/vehicle/1
{"id":1,"make":"Honda","model":"Civic","year":1990}

mvn io.quarkus.platform:quarkus-maven-plugin:3.21.0:create \
    -DprojectGroupId=at.htl \
    -DprojectArtifactId=backend-policy \
    -Dextensions='rest-jackson,oidc,hibernate-orm-panache,jdbc-postgresql,keycloak-authorization'
cd backend-policy

#### datasource configuration ####
quarkus.datasource.db-kind = postgresql
quarkus.datasource.username = app
quarkus.datasource.password = app
quarkus.datasource.jdbc.url = jdbc:postgresql://localhost:5432/db

#### hibernate configuration ####
quarkus.hibernate-orm.database.generation=drop-and-create
quarkus.hibernate-orm.physical-naming-strategy=org.hibernate.boot.model.naming.CamelCaseToUnderscoresNamingStrategy

#### keycloak configuration ####
quarkus.oidc.auth-server-url=http://localhost:8000/realms/demo
quarkus.oidc.client-id=backend
(1)
quarkus.oidc.credentials.secret=9xCZUZAkn4XPcraKU2vIGg3qiiJ2ieCa
(2)
quarkus.keycloak.policy-enforcer.enable=true

#### other ####
quarkus.devservices.enabled=false

package at.htl.feature.vehicle;

import jakarta.inject.Inject;
import jakarta.ws.rs.GET;
import jakarta.ws.rs.Path;
import jakarta.ws.rs.PathParam;

import java.util.List;

@Path("/vehicle/")
public class VehicleResource {
    @Inject
    VehicleRepository vehicleRepository;

    @GET
    public List<Vehicle> all() {
        return vehicleRepository.listAll();
    }

    @GET
    @Path("/{id}")
    public Vehicle byId(@PathParam("id") long id) {
        return vehicleRepository
                .findById(id);
    }
}