apache / apache/apisix

bug: resource creation fails using authz-keycloak plugin

Open
#12,547 4 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Lua
Stars
17.1k
Forks
2.9k
Avg merge
3d 16h
Merged PRs (30d)
63

Description

### Current Behavior

I'm trying to automatically create resources on keycloak using APISIX. Right now I am trying the following endpoint.

```
routes:
- id: "1"
uri: /image/*,
plugins:
openid-connect:
client_id: "apisix"
client_secret: "xxxx"
discovery: "http://keycloak:8080/realms/myrealm/.well-known/openid-configuration"
introspection_endpoint: "http://keycloak:8080/realms/idhub/protocol/openid-connect/token/introspect"
scope: "openid profile"
realm: "myrealm"
introspection_endpoint_auth_method: "client_secret_post"
set_access_token_header: true
session:
secret: "Y2RkMGM3NGItM2ZjNS00MDVjLTllMzctMmE5MDUxODllZTljCg=="
authz-keycloak:
client_id: "apisix"
client_secret: "xxxx"
lazy_load_paths: True
discovery: "http://keycloak:8080/realms/myrealm/.well-known/uma2-configuration"
resource_registration_endpoint: "http://keycloak:8080/realms/myrealm/authz/protection/resource_set"
http_method_as_scope: True
upstream:
type: roundrobin,
nodes:
"httpbin.org:80": 1
#END
```

Then I try to run a GET at http://localhost:8000/image/png, getting the following.

```
{"error":"invalid_resource","error_description":"Resource with id [bc7b3d5f-2e52-40f7-ae53-23e45969faa5] does not exist."}
```

### Expected Behavior

APISIX should create the resource in keycloak using the resource creation endpoint.

### Error Logs

```
idhub-keycloak | 2025-08-26 07:51:05,789 WARN [org.keycloak.events] (executor-thread-4) type="PERMISSION_TOKEN_ERROR", realmId="2d04cb30-a128-4df7-b766-73991a9083ee", realmName="myrealm", clientId="apisix", userId="b54ea44d-7034-472a-902c-d37e9cc7cefc", ipAddress="172.18.0.2", error="invalid_request", reason="Resource with id [bc7b3d5f-2e52-40f7-ae53-23e45969faa5] does not exist.", auth_method="oauth_credentials", audience="apisix", grant_type="urn:ietf:params:oauth:grant-type:uma-ticket", permission="bc7b3d5f-2e52-40f7-ae53-23e45969faa5#GET"
api-gateway | 2025/08/26 07:51:05 [error] 32#32: *194104 [lua] authz-keycloak.lua:664: evaluate_permissions(): Request denied: Token endpoint returned an error (status: 400, body: {"error":"invalid_resource","error_description":"Resource with id [bc7b3d5f-2e52-40f7-ae53-23e45969faa5] does not exist."})., client: 172.18.0.1, server: _, request: "GET /image/png HTTP/1.1", host: "localhost:8000"
api-gateway | 2025/08/26 07:51:05 [warn] 32#32: *194104 [lua] plugin.lua:1160: run_plugin(): authz-keycloak exits with http status code 400, client: 172.18.0.1, server: _, request: "GET /image/png HTTP/1.1", host: "localhost:8000"
```

### Steps to Reproduce

1. Run APISIX via the docker image with the provided endpoint in the apisix.yaml
2. Create a keycloak configured with the apisix client and uma
3. Run the HTTP request provided.

### Environment

- APISIX version (run `apisix version`): 3.9.1
- Operating system (run `uname -a`): apisix docker container
- OpenResty / Nginx version (run `openresty -V` or `nginx -V`): openresty/1.25.3.1
- etcd version, if relevant (run `curl http://127.0.0.1:9090/v1/server_info`):
- APISIX Dashboard version, if relevant:
- Plugin runner version, for issues related to plugin runners:
- LuaRocks version, for installation issues (run `luarocks --version`):

Contributor guide

Open the contributing guide

Research direction

Start with the authz-keycloak configuration in apisix.yaml and the failure path at authz-keycloak.lua:664, then reproduce the GET request against the stated Keycloak setup. Trace how the resource registration endpoint is used before evaluate_permissions() requests the permission token. Done means the resource is created in Keycloak and the request no longer returns invalid_resource.

Written by the indexing model from the issue text.

Assessment

Tech stack
lua
Domain
api, authorization
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.