Skip to main content

Module authz_keycloak

featherbit::plugins::native

Module authz_keycloak 

Source
Expand description

Keycloak UMA authorization plugin (authz-keycloak).

Ports a faithful subset of Apache APISIX’s authz-keycloak plugin: the UMA 2.0 permission check against a Keycloak token endpoint. For each request the plugin takes the caller’s bearer access token and asks Keycloak whether it grants the configured permissions, using the urn:ietf:params:oauth:grant-type:uma-ticket grant with response_mode=decision — exactly the request APISIX’s evaluate_permissions builds. A 200 decision allows the request; anything else denies it.

§Implemented subset

  • Static, pre-configured permissions (with optional http_method_as_scope).
  • policy_enforcement_mode (ENFORCING / PERMISSIVE) for the empty-permission case.
  • ssl_verify and timeout.

§Deliberately NOT ported (documented deviations)

  • Discovery (discovery URL): configure token_endpoint directly.
  • lazy_load_paths / resource-registration lookups and the service-account (client_credentials) token dance — no dynamic resource resolution.
  • password_grant_token_generation_incoming_uri token minting.
  • Response/token caching and access_denied_redirect_uri redirects.

All denials and callout errors map to 403 (code AUTHZ_KEYCLOAK_DENIED) routed through the node’s error port.

Structs§

AuthzKeycloakPlugin
Performs a Keycloak UMA permission check per request.

Constants§

UMA_GRANT_TYPE 🔒

Functions§

decision_allows 🔒
Maps a Keycloak UMA response status to an allow/deny decision: only 200 (the decision endpoint’s “granted” response) allows.
encode_uma_body 🔒
Encodes the UMA permission-check request body as application/x-www-form-urlencoded, repeating permission per entry.
fetch_bearer 🔒
Extracts the bearer token from the Authorization header, normalizing to a Bearer -prefixed value (mirroring APISIX’s fetch_jwt_token).
form_encode 🔒
Percent-encodes a value for application/x-www-form-urlencoded bodies (unreserved characters pass through; space becomes +).
scoped_permissions 🔒
Applies http_method_as_scope: appends #<method> to each permission, or , <method> when a scope is already present (matching APISIX’s logic).