Quarkus Security Expert

Overview

Expert guidance for Quarkus 3.36.0 security, covering:

OIDC authentication (quarkus-oidc) for bearer-token APIs and web-app login (authorization code flow)
JWT RBAC (quarkus-smallrye-jwt) for MP JWT-style bearer tokens with role/group mapping
Authorization on endpoints and methods with @RolesAllowed, @Authenticated, @PermitAll, @DenyAll
Permission-based authorization with @PermissionsAllowed and (optional) permission checkers
Defense-in-depth defaults like quarkus.security.jaxrs.deny-unannotated-endpoints=true
Identity customization with SecurityIdentityAugmentor
Testing secured endpoints with Quarkus test security annotations