///////////////////////////////////////////////////////////////////////////////

    Copyright (c) 2018,2019 Oracle and/or its affiliates. All rights reserved.

    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.
    You may obtain a copy of the License at

        http://www.apache.org/licenses/LICENSE-2.0

    Unless required by applicable law or agreed to in writing, software
    distributed under the License is distributed on an "AS IS" BASIS,
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
    limitations under the License.

///////////////////////////////////////////////////////////////////////////////

= Adding Security
:description: Helidon MicroProfile security
:keywords: helidon, microprofile, micro-profile

To add security, such as protecting
resource methods with authentication, to a MicroProfile application, add the Helidon
 security integration dependency to your project.

== Maven Coordinates

[source,xml]
.Maven Dependency
----
<dependency>
  <groupId>io.helidon.microprofile</groupId>
  <artifactId>helidon-microprofile-security</artifactId>
</dependency>
----

=== Securing a Web Resource

For web server static content, see 
<<microprofile/06_configuration.adoc,Configuration Secrets.>>

For JAX-RS resources, declare security by adding annotations to a resource class or
 method. 

[source,java]
.Protected resource method
----
@GET
@io.helidon.security.annotations.Authenticated
@io.helidon.security.annotations.Authorized
// you can also use io.helidon.security.abac.role.RoleValidator.Roles
@RolesAllowed("admin")
public String adminResource(@Context io.helidon.security.SecurityContext securityContext) {
  return "you are " + securityContext.getUser();
}
----

Security in Helidon MicroProfile is built on top of Jersey's and can be enabled/disabled
using the property `security.jersey.enabled=[true|false]`.