Security and Microservices


1 - Setup the work environment
2 - Setup Istio
3 - Istio Ingress gateway via HTTPS/TLS
4 - Setup Keycloak
5 - Deploy the microservices to K8s
6 - Strict mTLS
7 - Istio Authorization
8 - Authentication in the Vue.js fronted
9 - Authorization in Quarkus app
Setup locally

9 - Authorization in Quarkus application

Quarkus comes with two great quides that describe how to use Keycloak in web apps and services:

This diagram shows the simplified architecture:

Developing protected Endpoints

The service Articles provides an endpoint ‘/articles’ which only users with the role ‘user’ can access. In the file, the Keycloak URL is defined as well as the client ID and secret.



Note the line This setting is important, so that the Articles service can receive the Authorization header from the Web-API service. I couldn’t find this in the Quarkus documentation, but Phillip Krüger from the Quarkus team provided this information.

Once you’ve configured your Quarkus application, implementing the endpoint is trivial. Here we use @RolesAllowed, but there are other annotations available, for example @Authenticated.

public Set<Article> getArticles() {  
   return articles;

This allows the test user Alice to invoke this endpoint, since she has the role `user.

Invoking protected Endpoints

The Web-API service has also a protected endpoint which has been implemented as above. Additionally it also invokes the Articles service. In order to do this, the MicroProfile REST Client is used.

Let’s take at the configuration first.


Again, the last line (6) is important: This allows forwarding the authorization header with the JWT token without having to implement any code.

private ArticlesService articlesService;
void initialize() {
   URI apiV1 = UriBuilder.fromUri("http://{host}:{port}/articles").build(articlesHost, articlesPort);     
   articlesService = RestClientBuilder.newBuilder()
public List<CoreArticle> getArticles(int amount) throws NoConnectivity {
   try {
      return articlesService.getArticlesFromService(amount);
   } catch (Exception e) {
      throw new NoConnectivity(e);

Related blog post