Struct AuthzKeycloakPlugin 

pub struct AuthzKeycloakPlugin {
    token_endpoint: String,
    client_id: String,
    permissions: Vec<String>,
    enforcing: bool,
    http_method_as_scope: bool,
    ssl_verify: bool,
    timeout: Duration,
    outbound: Arc<OutboundClient>,
}

Performs a Keycloak UMA permission check per request.

Fields

token_endpoint: String

Keycloak token endpoint (.../protocol/openid-connect/token).

client_id: String

OAuth client id, sent as the UMA audience.

permissions: Vec<String>

Statically configured permissions (resource or resource#scope).

enforcing: bool

ENFORCING (default) denies when no permission is configured; PERMISSIVE allows.

http_method_as_scope: bool

When true, the request method is appended as the permission scope.

ssl_verify: bool

TLS certificate verification for the callout.

timeout: Duration

Whole-call timeout for the callout.

outbound: Arc<OutboundClient>

Shared pooled outbound HTTP client.

Implementations

impl AuthzKeycloakPlugin

pub fn from_config( config: &HashMap<String, Value>, resources: &Arc<PluginResources>, ) -> Result<Self, String>

Builds the plugin from node config.

Accepted keys:

• token_endpoint (string, required): Keycloak token endpoint URL. (APISIX’s discovery auto-resolution is not supported.)
• client_id (string, required): OAuth client id, sent as the UMA audience.
• permissions (array of strings, default []): requested permissions, each resource or resource#scope.
• policy_enforcement_mode (string, default "ENFORCING"): ENFORCING denies when permissions is empty; PERMISSIVE allows without a callout.
• http_method_as_scope (bool, default false): append the request method as the scope of each permission.
• ssl_verify (bool, default true): verify the endpoint’s TLS certificate.
• timeout (integer ms, default 3000): callout timeout.

- id: authz
  type: authz-keycloak
  config:
    token_endpoint: https://kc.example.com/realms/myrealm/protocol/openid-connect/token
    client_id: my-api
    permissions: ["Default Resource#read"]
    policy_enforcement_mode: ENFORCING
    ssl_verify: true
    timeout: 3000

fn deny( ctx: Context, message: impl Into<String>, ) -> Result<PluginOutput, PluginExecutionError>

Builds the 403 denial and exits on the denied port. Reserved for deliberate denials — a missing bearer token, no permission configured under ENFORCING, or Keycloak actively refusing the UMA decision.

fn callout_error( ctx: Context, message: String, ) -> Result<PluginOutput, PluginExecutionError>

Builds a genuine infrastructure-failure Err (the Keycloak token endpoint unreachable, timed out, or answering with a status that is not a decision) — exits through the error port because the node could not do its job, unlike deny which is a deliberate, client-facing decision. The prepared response is the shared 502 provider_error shape, not a 403 that would hide a broken deployment behind a plausible denial.

Trait Implementations

impl Plugin for AuthzKeycloakPlugin

fn plugin_type(&self) -> &str

Unique identifier for the plugin type (e.g., “proxy-rewrite”, “upstream”). This is also the key its PortSpec is registered under in port_spec.

fn execute<'life0, 'async_trait>( &'life0 self, ctx: Context, ) -> Pin<Box<dyn Future<Output = Result<PluginOutput, PluginExecutionError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Executes the plugin logic against the request/response context.

fn reads_response_body(&self) -> bool

Whether this configured instance reads context.response.body.

fn cache_target(&self) -> Option<CacheTarget>

The cache backend this node writes to, if it is a proxy-cache half.