Module authz_keycloak 

Keycloak UMA authorization plugin (authz-keycloak).

Ports a faithful subset of Apache APISIX’s authz-keycloak plugin: the UMA 2.0 permission check against a Keycloak token endpoint. For each request the plugin takes the caller’s bearer access token and asks Keycloak whether it grants the configured permissions, using the urn:ietf:params:oauth:grant-type:uma-ticket grant with response_mode=decision — exactly the request APISIX’s evaluate_permissions builds. A 200 decision allows the request; a 401/403 is Keycloak refusing it; any other status means no decision was obtained at all (see classify_decision).

Implemented subset

• Static, pre-configured permissions (with optional http_method_as_scope).
• policy_enforcement_mode (ENFORCING / PERMISSIVE) for the empty-permission case.
• ssl_verify and timeout.

Deliberately NOT ported (documented deviations)

• Discovery (discovery URL): configure token_endpoint directly.
• lazy_load_paths / resource-registration lookups and the service-account (client_credentials) token dance — no dynamic resource resolution.
• password_grant_token_generation_incoming_uri token minting.
• Response/token caching and access_denied_redirect_uri redirects.

Deliberate denials (missing bearer, no configured permission under ENFORCING, or a 401/403 UMA decision) map to 403 and exit through the dedicated denied port. Genuine failures exit through the ordinary error port instead, since the node could not do its job: the Keycloak token endpoint unreachable or timing out, and any unexpected status from it (400, 404 from a misconfigured endpoint path, 5xx). Only a status Keycloak uses to express an access verdict is treated as a verdict — otherwise a broken deployment would masquerade as a legitimate 403.

Structs

AuthzKeycloakPlugin

Performs a Keycloak UMA permission check per request.

Enums

Decision 🔒

What a Keycloak UMA response_mode=decision reply means.

Constants

UMA_GRANT_TYPE 🔒

Functions

classify_decision 🔒

Classifies a Keycloak UMA response status.

encode_uma_body 🔒

Encodes the UMA permission-check request body as application/x-www-form-urlencoded, repeating permission per entry.

fetch_bearer 🔒

Extracts the bearer token from the Authorization header, normalizing to a Bearer -prefixed value (mirroring APISIX’s fetch_jwt_token).

form_encode 🔒

Percent-encodes a value for application/x-www-form-urlencoded bodies (unreserved characters pass through; space becomes +).

scoped_permissions 🔒

Applies http_method_as_scope: appends #<method> to each permission, or , <method> when a scope is already present (matching APISIX’s logic).