anchor.diff:  = Quarkus - Security Tips and Tricks
   
   include::./attributes.adoc[]
  +
  +== Quarkus Security Dependency
  +
  +`io.quarkus:quarkus-security` module contains the core Quarkus security classes.
  +
  +In most cases it does not have to be added directly to your project's `pom.xml` as it is already provided by all of the security extensions.
  +However if you need to write your own custom security code (for example, register a <<jaxrs-security-context, Custom JAX-RS SecurityContext>>) or use <<bouncy-castle, BouncyCastle>> libraries, then please make sure it is included:
  +
  +[source,xml]
  +----
  +<dependency>
  +  <groupId>io.quarkus</groupId>
  +  <artifactId>quarkus-security</artifactId>
  +</dependency>
  +----
   
   == HttpAuthenticationMechanism Customization
   
  
positive.code: quarkus.security.security-providers=SunRsaSign,SunJCE
  ----
  
  === BouncyCastle
  
  If you need to register an `org.bouncycastle.jce.provider.BouncyCastleProvider` JCE provider then please set a `BC` provider name:
  
negative.code: You can enforce the order by implementing a default `SecurityIdentityAugmentor#priority` method. Augmentors with higher priorities will be invoked first.
  ===
  
  [[jaxrs-security-context]]
  == Custom JAX-RS SecurityContext
  
  If you use JAX-RS `ContainerRequestFilter` to set a custom JAX-RS `SecurityContext` then make sure `ContainerRequestFilter` runs in the JAX-RS pre-match phase by adding a `@PreMatching` annotation to it for this custom security context to be linked with Quarkus `SecurityIdentity`, for example:
  