Hi, I would like to use Keycloak as an Authorization black-box (PDP in ABAC terms) for authorization on API GW. What I am looking for: Keycloak has the rules Authorized client passes request in structure subject-action-object Keycloak responds yes/no Note that “subject” can be offline user. Th…

I’m not a Keycloak expert, but this doc might help you: https://www.keycloak.org/docs/latest/authorization_services/index.html Keycloak does have authorization features, and it looks like the “Protection API” might fit your use case?

Thank you, @bjmc . I learned something about OAuth 2.0 and OIDC. It looks like it solves access to user’s data. What if I want to guard business data in general?

To reiterate my question: Can I forge authorization request for any user (not just the authenticated one) ? Based on documentation, the policies are evaluated by Policy Enforcer, and permissions are bound to bearer token.

What if I want to guard business data in general? This is an extremely broad question. The only thing I can really say is that OAuth2/OIDC don’t have anything to do directly with securing data. It’s the responsibility of the application holding the data to store it securely and restrict access so…

Be aware of the token generation. We didn’t find a way how to generate token externally to Keycloak. My understanding that you have to create a token using Keycloak, Keycloak should be aware of the user(subject), so you probably need to integrate it with you users management. If Keycloak isn’t an au…

Thank you bmjc for your thoughts! Thank you dginzbourg for technical insight! We decided not to try to make PDP from Keycloak. After some evaluation, the limiting factors were the fact, that Keycloak can only decide yes/no on policy request, but further auditing of policies is something that had t…

Hi, i am also interested in this subject. The documentation mainly describes the usage of keycloaks authz service as the PDP/PIP… BUT is there a way to use an external AuthZ PDP/PIP (such as axiomatics etc) with keycloak acting as a PEP. So Keycloak is the PEP creating xacml authorization decision …

thanks but you dont understand my question –topic should actually be called keycloak as client from an external authorization service… again: can keycloak (technically) act as a PEP externalizing its autorization decisions towards a real abac based authz engine ? Like axiomatics or an ngac based…

When reporting an issue, it is important to explain which standard you are implementing. A diagram on paper that only shows PEP, PIP, and PDP does not say much by itself. Technically, almost anything is possible, but we usually recommend following open standards, or at least proposed standards. I r…

Keycloak as an Authorization Service

Getting advice

dasniko December 16, 2025, 3:38pm 9

AN. IDP. IS. NEVER. THE. PEP!
We had this several time here in various threads. Last time not a week ago here: Role Policy configuration - #4 by dasniko

Topic		Replies	Views
Keycloak just as Authorization Server	14	3304	March 8, 2022
How Authorization is supposed to work? Getting advice oidc	1	352	February 17, 2024
Extending Keycloak Authorization Using External Data Extending the server	3	1071	June 1, 2022
Keycloak and OPA integration	17	13873	August 30, 2022
Some questions about keycloak	1	171	March 25, 2024

Keycloak as an Authorization Service

Related topics