<commit_before>////
This guide is maintained in the main Quarkus repository
and pull requests should be submitted there:
https://github.com/quarkusio/quarkus/tree/master/docs/src/main/asciidoc
////
= Quarkus - Using OpenID Connect and OAuth2 Client and Filters to acquire, refresh and propagate access tokens

include::./attributes.adoc[]
:toc:

This guide explains how to use Quarkus `quarkus-oidc-client`, `quarkus-oidc-client-filter` and `quarkus-oidc-token-propagation` extensions to acquire and refresh access tokens from OpenId Connect and OAuth 2.0 compliant Authorization Servers such as https://www.keycloak.org/about.html[Keycloak] and use these tokens as HTTP Authorization Bearer tokens to access the remote services.

== OidcClient

`quarkus-oidc-client` extension provides a reactive `io.quarkus.oidc.client.OidcClient` which can be used to acquire and refresh tokens using Smallrye Mutiny `Uni` and `Vert.x WebClient`.

`OidcClient` is initialized at the build time with the IDP token endpoint URL which can be auto-discovered or manually configured and uses this endpoint to acquire access tokens using `client_credentials` or `password` token grants and refresh the tokens using `refresh_token` grant.

Here is how `OidcClient` can be configured to use the `client_credentials` grant:

```
quarkus.oidc-client.auth-server-url=${keycloak.url}/realms/quarkus2/
quarkus.oidc-client.client-id=quarkus-app
quarkus.oidc-client.credentials.secret=secret
```

Here is how `OidcClient` can be configured to use the `password` grant:<commit_msg>Make the oidc-client doc title shorter and try to improve the introduction<commit_after>////
This guide is maintained in the main Quarkus repository
and pull requests should be submitted there:
https://github.com/quarkusio/quarkus/tree/master/docs/src/main/asciidoc
////
= Quarkus - Using OpenID Connect and OAuth2 Client and Filters to manage access tokens

include::./attributes.adoc[]
:toc:

This guide explains how to use:
 * `quarkus-oidc-client` and `quarkus-oidc-client-filter` extensions to acquire and refresh access tokens from OpenId Connect and OAuth 2.0 compliant Authorization Servers such as https://www.keycloak.org/about.html[Keycloak]
 * `quarkus-oidc-token-propagation` extension to propagate the current bearer or authorization code flow access tokens

The access tokens managed by these extensions can be used as HTTP Authorization Bearer tokens to access the remote services.

== OidcClient

`quarkus-oidc-client` extension provides a reactive `io.quarkus.oidc.client.OidcClient` which can be used to acquire and refresh tokens using Smallrye Mutiny `Uni` and `Vert.x WebClient`.

`OidcClient` is initialized at the build time with the IDP token endpoint URL which can be auto-discovered or manually configured and uses this endpoint to acquire access tokens using `client_credentials` or `password` token grants and refresh the tokens using `refresh_token` grant.

Here is how `OidcClient` can be configured to use the `client_credentials` grant:

```
quarkus.oidc-client.auth-server-url=${keycloak.url}/realms/quarkus2/
quarkus.oidc-client.client-id=quarkus-app
quarkus.oidc-client.credentials.secret=secret
```

Here is how `OidcClient` can be configured to use the `password` grant:
{'fraction_non_alphanumeric': 0.0803680981595092, 'fraction_numerical': 0.00245398773006135, 'mean_word_length': 5.106741573033708, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 4, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3953265', 'n_tokens_mistral': 966, 'n_tokens_neox': 920, 'n_words': 366}