{"id":18336564,"url":"https://github.com/kumuluz/kumuluzee-security","last_synced_at":"2025-10-17T14:16:51.758Z","repository":{"id":57726030,"uuid":"92406680","full_name":"kumuluz/kumuluzee-security","owner":"kumuluz","description":"KumuluzEE Security extension for easy integration with OAuth2/OpenID identity and access management providers.","archived":false,"fork":false,"pushed_at":"2023-06-09T13:00:20.000Z","size":147,"stargazers_count":5,"open_issues_count":0,"forks_count":2,"subscribers_count":12,"default_branch":"master","last_synced_at":"2025-03-21T17:24:58.672Z","etag":null,"topics":["cloud-native","java","javaee","kumuluzee","microservices","oauth2","openid-connect","security"],"latest_commit_sha":null,"homepage":"https://ee.kumuluz.com","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kumuluz.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2017-05-25T13:35:45.000Z","updated_at":"2023-05-09T13:37:46.000Z","dependencies_parsed_at":"2022-09-17T14:00:27.981Z","dependency_job_id":"6c319d0a-522c-4c84-ae31-dd3738177555","html_url":"https://github.com/kumuluz/kumuluzee-security","commit_stats":{"total_commits":73,"total_committers":14,"mean_commits":5.214285714285714,"dds":0.6301369863013699,"last_synced_commit":"3b757d62f188e81b61f1b4a0941439873df3924d"},"previous_names":[],"tags_count":5,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kumuluz%2Fkumuluzee-security","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kumuluz%2Fkumuluzee-security/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kumuluz%2Fkumuluzee-security/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kumuluz%2Fkumuluzee-security/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kumuluz","download_url":"https://codeload.github.com/kumuluz/kumuluzee-security/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247435041,"owners_count":20938530,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cloud-native","java","javaee","kumuluzee","microservices","oauth2","openid-connect","security"],"created_at":"2024-11-05T20:08:16.467Z","updated_at":"2025-10-17T14:16:46.717Z","avatar_url":"https://github.com/kumuluz.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# KumuluzEE Security\n[![KumuluzEE CI](https://github.com/kumuluz/kumuluzee-security/actions/workflows/kumuluzee-ci.yml/badge.svg)](https://github.com/kumuluz/kumuluzee-security/actions/workflows/kumuluzee-ci.yml)\n\n\u003e KumuluzEE Security extension for the Kumuluz EE microservice framework. \n\nKumuluzEE Security is a security project for the KumuluzEE microservice framework. It provides support for OpenID \nauthentication through standard Java EE security annotations for roles. It is specifically targeted towards securing \nREST services. Roles are mapped to the selected OpenID provider. KumuluzEE Security has been designed to work with \ndifferent OpenID providers. \n\n## Providers\n\nCurrently, the following providers are supported:\n* [Keycloak](/keycloak/README.md)\n* [Firebase](/firebase/README.md)\n\nContributions for other OpenID providers are welcome.\n\n## Security configuration\n\nTo protect a REST service using KumuluzEE Security authentication you have to annotate the REST application class with \nthe `@DeclareRoles` annotation:\n````java\n@DeclareRoles({\"role1\", \"role2\"})\npublic class RestApplication extends Application {\n    \n}\n````\n\nAlternatively, you can also annotate it with `@Keycloak` or `@FirebaseAuth`.\n\n\nIt is possible to specify security constraints for JAX-RS resources using the standard `@DenyAll`, `@PermitAll` and\n`@RolesAllowed` Java annotations.\n \nExample of security constraints:\n ```java\n@Consumes(MediaType.APPLICATION_JSON)\n@Produces(MediaType.APPLICATION_JSON)\n@Path(\"customers\")\n@Secure\npublic class CustomerResource {\n\n    @GET\n    @Path(\"{customerId}\")\n    @PermitAll\n    public Response getCustomer(@PathParam(\"customerId\") String customerId) {\n        ...\n    }\n\n    @POST\n    @RolesAllowed(\"user\")\n    public Response addNewCustomer(Customer customer) {\n        ...\n    }\n}\n```\n\n**NOTE**: When using the non CDI security constraint annotations, note that these constraints behave as if they were \ndeclared in the **web.xml** descriptor, i.e. the url patterns do not support path parameters.\n\nThe security extension also supports CDI based security, which means that security constraints are checked and resolved \nduring method invocation. To enable CDI based security just add `@Secure` annotation to the CDI bean and use the \nstandard Java security annotations as before.\n\nExample of CDI based security:\n```java\n@RequestScoped\n@Secure\n@PermitAll\npublic class CustomerResource {\n\n    @RolesAllowed(\"user\")\n    public Customer getCustomer(String customerId) {\n        ...\n    }\n\n    @RolesAllowed(\"admin\")\n    public void addNewCustomer(Customer customer) {\n        ...\n    }\n}\n``` \n\nWhen using the CDI based security it is also possible to provide application role mappings. The specified role mappings \ntransform provider roles into internal application roles. Role mappings are defined using the `kumuluzee.security.roles`\nkey.\n\nExample role mapping configuration:\n```yaml\nkumuluzee:\n  security:\n    roles:\n      user: role_user # 'user' from provider will be mapped to 'role_user' in this service\n      admin: role_admin\n```\n\n## Additional configuration\n\nYou may also disable Jetty servlet security, which is enabled by default, by setting key `kumuluzee.security.disable-jetty-auth` to `true`.\n\n## Changelog\n\nRecent changes can be viewed on Github on the [Releases Page](https://github.com/kumuluz/kumuluzee-security/releases)\n\n## Contribute\n\nSee the [contributing docs](https://github.com/kumuluz/kumuluzee-security/blob/master/CONTRIBUTING.md)\n\nWhen submitting an issue, please follow the \n[guidelines](https://github.com/kumuluz/kumuluzee-security/blob/master/CONTRIBUTING.md#bugs).\n\nWhen submitting a bugfix, write a test that exposes the bug and fails before applying your fix. Submit the test \nalongside the fix.\n\nWhen submitting a new feature, add tests that cover the feature.\n\n## License\n\nMIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkumuluz%2Fkumuluzee-security","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkumuluz%2Fkumuluzee-security","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkumuluz%2Fkumuluzee-security/lists"}