/**
 * Licensed to the Apache Software Foundation (ASF) under one or more
 * contributor license agreements.  See the NOTICE file distributed with
 * this work for additional information regarding copyright ownership.
 * The ASF licenses this file to You under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 * <p>
 * http://www.apache.org/licenses/LICENSE-2.0
 * <p>
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.obsidiantoaster.quickstart;

import io.vertx.core.AbstractVerticle;
import io.vertx.core.Future;
import io.vertx.core.json.JsonObject;
import io.vertx.ext.auth.jwt.JWTAuth;
import io.vertx.ext.web.Router;
import io.vertx.ext.web.handler.JWTAuthHandler;
import io.vertx.ext.web.handler.StaticHandler;
import org.obsidiantoaster.quickstart.service.Greeting;

import static io.vertx.core.http.HttpHeaders.CONTENT_TYPE;

public class RestApplication extends AbstractVerticle {


  private long counter;

  @Override
  public void start(Future done) {
    // Create a router object.
    Router router = Router.router(vertx);

    JsonObject config = new JsonObject()
      .put("realm", System.getenv("REALM"))
      .put("public-key", System.getenv("REALM_PUBLIC_KEY"))
      .put("auth-server-url", System.getenv("SSO_URL"))
      .put("ssl-required", "external")
      .put("resource", System.getenv("CLIENT_ID"))
      .put("credentials", new JsonObject()
        .put("secret", System.getenv("CREDENTIALS")));

    // Configure the AuthHandler to process JWT's
    router.route("/greeting").handler(JWTAuthHandler.create(JWTAuth.create(vertx, config)));

    router.get("/greeting").handler(ctx -> {
      String name = ctx.request().getParam("name");
      if (name == null) {
        name = "World";
      }
      ctx.response()
        .putHeader(CONTENT_TYPE, "application/json; charset=utf-8")
        .end(new Greeting(++counter, name).encode());
    });

    // serve the dynamic config so the web client
    // can also connect to the SSO server
    router.get("/keycloak.json").handler(ctx -> {
      ctx.response()
        .putHeader(CONTENT_TYPE, "application/json; charset=utf-8")
        .end(config.encode());
    });

    // serve static files (web client)
    router.get().handler(StaticHandler.create());

    // Create the HTTP server and pass the "accept" method to the request handler.
    vertx
      .createHttpServer()
      .requestHandler(router::accept)
      .listen(
        // Retrieve the port from the configuration,
        // default to 8080.
        config().getInteger("http.port", 8080),
        done.completer());
  }
}

@@ -1824,151 +1824,642 @@
 %22)))
-;%0A%0A    // Configure the AuthHandler to process JWT's%0A    router.route(%22/greeting%22).handler(JWTAuthHandler.create(JWTAuth.create(vertx, config))
+%0A      // since we're consuming keycloak JWTs we need to locate the permission claims in the token%0A      .put(%22permissionsClaimKey%22, %22realm_access/roles%22);%0A%0A    // Configure the AuthHandler to process JWT's%0A    router.route(%22/greeting%22).handler(JWTAuthHandler.create(JWTAuth.create(vertx, config)));%0A%0A    // This is how one can do RBAC, e.g.: only admin is allowed%0A    router.get(%22/greeting%22).handler(ctx -%3E %7B%0A      ctx.user().isAuthorised(%22admin%22, authz -%3E %7B%0A        if (authz.succeeded() && authz.result()) %7B%0A          ctx.next();%0A        %7D else %7B%0A          ctx.fail(new RuntimeException(%22AuthZ failed!%22));%0A        %7D%0A      %7D);%0A    %7D
 );%0A%0A

Complete the Quickstart with basic RBAC check (AuthZ)