# Client policy in keycloak authorization server return Deny for allowed client

**URL:** <https://forum.keycloak.org/t/client-policy-in-keycloak-authorization-server-return-deny-for-allowed-client/25632>\
**Category:** Miscellanaeous\
**Created:** [April 17, 2024, 4:58pm UTC](https://forum.keycloak.org/t/client-policy-in-keycloak-authorization-server-return-deny-for-allowed-client/25632 "2024-04-17T16:58:51Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![eitanby](https://avatars.discourse-cdn.com/v4/letter/e/58956e/32.png) [@eitanby](https://forum.keycloak.org/u/eitanby)\
**Post date:** [April 17, 2024, 4:58pm UTC](https://forum.keycloak.org/t/client-policy-in-keycloak-authorization-server-return-deny-for-allowed-client/25632/1 "2024-04-17T16:58:51Z")

</div>

I configure keycloak (**[quay.io/keycloak/keycloak:24.0.2](http://quay.io/keycloak/keycloak:24.0.2)**) with two clients:

1. **store-700**
2. **my-resource-server**

I also set my **my-resource-server** as a resource server and set it like that:

1. created _scope_ named **upload**
2. created _resource_ named **transaction** (with scope: **upload** )
3. created _policy_ named ‘store-clients’: type of **Client Policy** (and allow client-id **store-700** )
4. created _permission_ named ‘permission-700’ which allow access to **transaction:upload**

this is my overall configuration:

```
{
"allowRemoteResourceManagement": true,
"policyEnforcementMode": "ENFORCING",
"resources": [
	{
		"name": "transaction",
		"ownerManagedAccess": false,
		"displayName": "",
		"attributes": {},
		"_id": "e61bc461-85d4-4390-af7b-d594c5f4c6d7",
		"uris": [],
		"scopes": [
			{
				"name": "upload"
			}
		],
		"icon_uri": ""
	}
],
"policies": [
	{
		"id": "c2fec000-591d-41e2-94e7-6062bca6ca5b",
		"name": "store-clients",
		"description": "",
		"type": "client",
		"logic": "POSITIVE",
		"decisionStrategy": "UNANIMOUS",
		"config": {
			"clients": "[\"store-700\"]"
		}
	},
	{
		"id": "82cdb7dd-a70b-4272-abbd-f9d941fbdd27",
		"name": "permission-700",
		"description": "",
		"type": "scope",
		"logic": "POSITIVE",
		"decisionStrategy": "UNANIMOUS",
		"config": {
			"resources": "[\"transaction\"]",
			"scopes": "[\"upload\"]",
			"applyPolicies": "[\"store-clients\"]"
		}
	}
],
"scopes": [
	{
		"id": "9b14076d-17a9-42a8-a8ac-a0c98dc253ca",
		"name": "upload",
		"iconUri": ""
	}
],
"decisionStrategy": "UNANIMOUS"}

```

When I am trying to evaluate this in the Evaluate tab I get **Deny** :

 ![evaluate-kc](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/b/bbac18a4c1eb840f50c0c5963bdf3a01a2c72dfa.png)  
 ![evaluate-deny-kc](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/8/874ca74c93a9835136d9b547ded9861513e95d01.png)