Struct AuthzKeycloakPlugin 

pub struct AuthzKeycloakPlugin {
    token_endpoint: String,
    client_id: String,
    permissions: Vec<String>,
    enforcing: bool,
    http_method_as_scope: bool,
    ssl_verify: bool,
    timeout: Duration,
    outbound: Arc<OutboundClient>,
}

Performs a Keycloak UMA permission check per request.

Fields

token_endpoint: String

Keycloak token endpoint (.../protocol/openid-connect/token).

client_id: String

OAuth client id, sent as the UMA audience.

permissions: Vec<String>

Statically configured permissions (resource or resource#scope).

enforcing: bool

ENFORCING (default) denies when no permission is configured; PERMISSIVE allows.

http_method_as_scope: bool

When true, the request method is appended as the permission scope.

ssl_verify: bool

TLS certificate verification for the callout.

timeout: Duration

Whole-call timeout for the callout.

outbound: Arc<OutboundClient>

Shared pooled outbound HTTP client.

Implementations

impl AuthzKeycloakPlugin

pub fn from_config( config: &HashMap<String, Value>, resources: &Arc<PluginResources>, ) -> Result<Self, String>

Builds the plugin from node config.

Accepted keys:

• token_endpoint (string, required): Keycloak token endpoint URL. (APISIX’s discovery auto-resolution is not supported.)
• client_id (string, required): OAuth client id, sent as the UMA audience.
• permissions (array of strings, default []): requested permissions, each resource or resource#scope.
• policy_enforcement_mode (string, default "ENFORCING"): ENFORCING denies when permissions is empty; PERMISSIVE allows without a callout.
• http_method_as_scope (bool, default false): append the request method as the scope of each permission.
• ssl_verify (bool, default true): verify the endpoint’s TLS certificate.
• timeout (integer ms, default 3000): callout timeout.

- id: authz
  type: authz-keycloak
  config:
    token_endpoint: https://kc.example.com/realms/myrealm/protocol/openid-connect/token
    client_id: my-api
    permissions: ["Default Resource#read"]
    policy_enforcement_mode: ENFORCING
    ssl_verify: true
    timeout: 3000

fn deny( ctx: Context, message: impl Into<String>, ) -> Result<PluginOutput, PluginExecutionError>

Builds the 403 denial carrying the context.

Trait Implementations

impl Plugin for AuthzKeycloakPlugin

fn plugin_type(&self) -> &str

Unique identifier for the plugin type (e.g., “proxy-rewrite”, “upstream”).

fn execute<'life0, 'life1, 'async_trait>( &'life0 self, ctx: Context, _named_inputs: &'life1 HashMap<String, Value>, ) -> Pin<Box<dyn Future<Output = Result<PluginOutput, PluginExecutionError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Executes the plugin logic against the request/response context.