// // Copyright (c) 2016-2020 Contributors to the Eclipse Foundation // // See the NOTICES file(s) distributed with this work for additional // information regarding copyright ownership. // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. //
Today, the most common solutions involving RESTful and microservices security are based on http://openid.net/connect/[OpenID Connect (OIDC)], https://tools.ietf.org/html/rfc6749[OAuth2] and https://tools.ietf.org/html/rfc7519[JSON Web Token (JWT)] standards.
This specification outlines how the signed JWT tokens issued by OIDC and other trusted providers can be verified and their claims used for Role Based Access Control (RBAC) of microservice endpoints.
For RESTful based microservices, security tokens in a JWT format offer a lightweight and interoperable way to propagate identities across different services, where:
For links to the latest maven artifacts, Javadoc and specification document, see the link:https://github.com/eclipse/microprofile-jwt-auth/releases/latest[latest release].