# Authorization decision get ignored

**URL:** <https://forum.keycloak.org/t/authorization-decision-get-ignored/20741>\
**Category:** Configuring the server\
**Created:** [March 9, 2023, 12:30pm UTC](https://forum.keycloak.org/t/authorization-decision-get-ignored/20741 "2023-03-09T12:30:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mdc\_tux](https://avatars.discourse-cdn.com/v4/letter/m/779978/32.png) [@mdc\_tux](https://forum.keycloak.org/u/mdc_tux)\
**Post date:** [March 9, 2023, 12:30pm UTC](https://forum.keycloak.org/t/authorization-decision-get-ignored/20741/1 "2023-03-09T12:30:55Z")

</div>

Hi,  
I have create an authorization policy for an OpenID client.  
When I use the “Evaluate” function to test it, I see the right results (Deny/Allow).  
But the end user are always logged into the application which is using Keycloak.  
So it looks like, that the decision of the authorization rules are not applied.

I using Keycloak 21.0.1

Is it an bug or do I something wrong?

---

<div class="post-metadata">

**Author:** ![mdc\_tux](https://avatars.discourse-cdn.com/v4/letter/m/779978/32.png) [@mdc\_tux](https://forum.keycloak.org/u/mdc_tux)\
**Post date:** [March 13, 2023, 5:14am UTC](https://forum.keycloak.org/t/authorization-decision-get-ignored/20741/2 "2023-03-13T05:14:43Z")

</div>

Solved, the app (client) was not UMA2 aware.