Quarkus has great support of OAuth 2 and OIDC protocol. In this post, we will explore how to protect RESTful APIs with Quarkus OIDC and Auth0.

Photo by Ling Tang on Unsplash

Quarkus is well-known as a supersonic subatomic Java framework to build Kubernetes-friendly cloud native applications. In an earlier post we have discussed how to secure RESTful APIs with Spring Security and Auth0, we will implement the same functionality with Quarkus OIDC extension.

Go to Quarkus Start Coding page, make sure you have added these extensions: oidc, resteasy, resteasy-jackson, hibernate-validator , hibernate-orm-panache, jdbc-postgresql. Then generate a project skeleton as usual that we have done in…

In the last post, we have built a simple GraphQL API example, now let’s discuss how to use GraphQL Client to interact with the backend GraphQL APIs.

The image is from https://unsplash.com/photos/6NzHYsK_-Ow

Generating Project Skeleton

Like what we have done in the past posts, you should prepare a project skeleton firstly.

Create a Quarkus project using Quarkus Code Generator, import the source codes into your IDE.

Open pom.xml file, add the following dependencies.


Lombok is used to erase the setters, getters, hashCode, equals, toString etc. …

GraphQL is used as an alternative of REST to build Web APIs and becomes more and more popular in these days.

What is GraphQL?

The initial GraphQL protocol is created by Facebook, and now it is maintained by the GraphQL Foundation. From the home page of the official GraphQL website, GraphQL was described as:

GraphQL is a query language for APIs and a runtime for fulfilling those queries with your existing data. …

Auth0 provides SDK for Angular to authenticate users and simply authorize users to access the protected APIs .

The image is from https://unsplash.com/photos/SEYO0Botkgc

In this post, we will create a simple Angular SPA application and try to access the Backend API we have created in the last post.

Firstly lets create a new application in the Auth0 management console. An application presents an OAuth2 Client role , each client should have a unique client id to identify it.

In the dashboard UI, expand Applications/applications in the left pane. Click the Create Application button to start up the creating progress.

  • In the application name, set a…

Spring Security 5 deprecated the original Spring Security OAuth module and rewrote the OAuth2/Oidc implementation, make it available as part of the core modules.

The image is from https://unsplash.com/photos/SwbsW4uf1Qs

OAuth protocol defines 4 roles, including Resource Owner, Client, Authorization server and Resource server. Imagine you are using an app in your mobile, you(Resource owner) authorizes the app(presents a Client role itself) to perform an authorization flow to get access token from the authorization server, then utilizes this token to interact with the protected resources(from Resource server).

Oidc is an additional supplement to enrich OAuth2 protocol. In Spring Security 5, it does not differentiate them explicitly…

The Spring Native beta is released, it is great news for Spring developers. Quarkus got GraalVM native image and Kubernetes support since it was born, and Micronaunt and Oracle Helidon also added GraalVM support for a long time.

The image is from https://unsplash.com/photos/sBNx8CBj12w

As explained in the GraalVM introduction page, GraalVM is a high-performance JDK distribution designed to accelerate the execution of applications written in Java and other JVM languages along with support for JavaScript, Ruby, Python, and a number of other popular languages. GraalVM’s polyglot capabilities make it possible to mix multiple programming languages in a single application while eliminating foreign language call costs.

Github is easy to share codes with others, for example I created jakartaee9-starter-boilerplate as a project template for Jakarta EE developers. For those who are familiar with Github, it is easy to start their new projects by forking or cloning this project directly. But obviously for a general Jakarta EE application, you do not need the configuraitons of all application severs, eg. Glassfish/Payara, WildFly, OpenLiberty, Apache TomEE, etc. For most of Java developers esp. …

I have created a jakartaee9-starter-boilerplate repository for developers to build a Jakarta EE 9 project. You can read the articles I have written for the codes.

The image is from https://unsplash.com/photos/RDW22bbsN0Y

I shared this project in the official Jakarta EE community mail list, and got that Eclipse EE4J starter project planned to provide a custom starter template for Jakarta EE 9. I was suggested to create a Maven archetype as a start point to share my work in the starter project. So I created another Maven archetype for Jakarta EE 9 repository for this purpose. …

In addition to Deploying Jakarta EE 9 applications to Apache TomEE, in this post using Cargo Maven Plugin instead.

We have discussed the deployment to Apache TomEE using the official tomee-maven-plugin. With tomee-maven-plugin, it is easy to download a copy of Apache TomEE distribution and start the TomEE server and then deploy the application to it. Or deploy your application to a running TomEE server. The official maven plugin is great for most cases, but it lacks the ability to deploy the application to a local installed server with fine-grained configurations.

Cargo maven plugin 1.8.3 brought updates to TomEE 9.0…

Payara Community 5.2020.5 has introduced tech preview functionality to run Jakarta EE 9 on Payara Server and Micro, more details please go to the release notes.

Originally Payara was a fork of the open-sourced Glassfish, but it includes a bundle of new features that not existed in Glassfish.

  • Numerous improvements and quicker bugfixes in comparison to the existing Glassfish
  • Java 11(or above) support
  • Built-in Microprofile support and ready for cloud native applications
  • Many third-party services integration.
  • Comprehensive documentation and technical guides
  • Commercial support available for paid enterprise users.

Payara Community is also open sourced, for developers, you use it as…


Self-employed technical consultant, solution architect and full-stack developer

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store