Skip to content
Documentation
Using
Resources
Client Authorization

Client Authorization

Use these resources when a client needs Keycloak Authorization Services for fine-grained access control and UMA-style policy evaluation. Define resources, permissions, and policies to protect APIs and services. The client must have authorization enabled.

API Reference

KindAPI GroupTerraform ResourceCRD Explorer
ClientAuthorizationResourceopenidclient.keycloak.crossplane.io/v1alpha1keycloak_openid_client_authorization_resourceView CRD Schema
ClientAuthorizationPermissionopenidclient.keycloak.crossplane.io/v1alpha1keycloak_openid_client_authorization_permissionView CRD Schema
ClientClientPolicyopenidclient.keycloak.crossplane.io/v1alpha1keycloak_openid_client_client_policyView CRD Schema
ClientGroupPolicyopenidclient.keycloak.crossplane.io/v1alpha1keycloak_openid_client_group_policyView CRD Schema
ClientRolePolicyopenidclient.keycloak.crossplane.io/v1alpha1keycloak_openid_client_role_policyView CRD Schema
ClientUserPolicyopenidclient.keycloak.crossplane.io/v1alpha1keycloak_openid_client_user_policyView CRD Schema
ClientRegexPolicyopenidclient.keycloak.crossplane.io/v1alpha1keycloak_openid_client_regex_policyView CRD Schema
ClientPermissionsopenidclient.keycloak.crossplane.io/v1alpha1keycloak_openid_client_permissionsView CRD Schema

Working YAML Examples

ClientAuthorizationResource 

apiVersion: openidclient.keycloak.crossplane.io/v1alpha1
kind: ClientAuthorizationResource
metadata:
  name: my-authz-resource
spec:
  providerConfigRef:
    name: "keycloak-provider-config"
  deletionPolicy: Delete
  forProvider:
    name: my-authz-resource
    displayName: My Authorization Resource
    type: "urn:test:resources:default"
    uris:
      - "/protected/resource"
    resourceServerIdRef:
      name: "test"
      policy:
        resolve: Always
    realmIdRef:
      name: "dev"
      policy:
        resolve: Always

ClientAuthorizationPermission 

apiVersion: openidclient.keycloak.crossplane.io/v1alpha1
kind: ClientAuthorizationPermission
metadata:
  name: my-authz-permission
spec:
  providerConfigRef:
    name: "keycloak-provider-config"
  deletionPolicy: Delete
  forProvider:
    name: my-authz-permission
    description: Permission covering all resources of a given type
    type: resource
    resourceType: "urn:test:resources:default"
    decisionStrategy: UNANIMOUS
    resourceServerIdRef:
      name: "test"
      policy:
        resolve: Always
    realmIdRef:
      name: "dev"
      policy:
        resolve: Always

spec.forProvider.policies, resources, and scopes map directly to the underlying Terraform provider fields, so their raw values are UUIDs / IDs, not names. If you want to wire managed Keycloak objects together by reference, use the generated reference fields instead, for example:

  • resourcesRefs / resourcesSelector
  • clientPoliciesRefs
  • groupPoliciesRefs
  • regexPoliciesRefs
  • rolePoliciesRefs
  • userPoliciesRefs

Supplying names in the raw policies, resources, or scopes lists causes drift because the Terraform provider reads those attributes back as resolved Keycloak IDs.

ClientClientPolicy 

apiVersion: openidclient.keycloak.crossplane.io/v1alpha1
kind: ClientClientPolicy
metadata:
  name: my-client-policy
spec:
  providerConfigRef:
    name: "keycloak-provider-config"
  deletionPolicy: Delete
  forProvider:
    name: my-client-policy
    clientsRefs:
      - name: "test"
        policy:
          resolve: Always
    decisionStrategy: UNANIMOUS
    logic: POSITIVE
    resourceServerIdRef:
      name: "test"
      policy:
        resolve: Always
    realmIdRef:
      name: "dev"
      policy:
        resolve: Always

ClientClientPolicy with OIDC and SAML clients

ClientClientPolicy also supports SAML clients through samlClientsRefs.

apiVersion: openidclient.keycloak.crossplane.io/v1alpha1
kind: ClientClientPolicy
metadata:
  name: my-oidc-and-saml-client-policy
spec:
  providerConfigRef:
    name: "keycloak-provider-config"
  deletionPolicy: Delete
  forProvider:
    name: my-oidc-and-saml-client-policy
    clientsRefs:
      - name: "test"
        policy:
          resolve: Always
    samlClientsRefs:
      - name: saml-client
        policy:
          resolve: Always
    decisionStrategy: UNANIMOUS
    logic: POSITIVE
    resourceServerIdRef:
      name: "test"
      policy:
        resolve: Always
    realmIdRef:
      name: "dev"
      policy:
        resolve: Always

ClientGroupPolicy 

apiVersion: openidclient.keycloak.crossplane.io/v1alpha1
kind: ClientGroupPolicy
metadata:
  name: my-group-policy
spec:
  providerConfigRef:
    name: "keycloak-provider-config"
  deletionPolicy: Delete
  forProvider:
    name: my-group-policy
    groups:
      - path: /test
        extendChildren: false
        idRef:
          name: "test"
    decisionStrategy: UNANIMOUS
    logic: POSITIVE
    resourceServerIdRef:
      name: "test"
      policy:
        resolve: Always
    realmIdRef:
      name: "dev"
      policy:
        resolve: Always

ClientRolePolicy 

apiVersion: openidclient.keycloak.crossplane.io/v1alpha1
kind: ClientRolePolicy
metadata:
  name: my-role-policy
spec:
  providerConfigRef:
    name: "keycloak-provider-config"
  deletionPolicy: Delete
  forProvider:
    name: my-role-policy
    type: role
    role:
      - required: true
        idRef:
          name: "test"
    decisionStrategy: UNANIMOUS
    logic: POSITIVE
    resourceServerIdRef:
      name: "test"
      policy:
        resolve: Always
    realmIdRef:
      name: "dev"
      policy:
        resolve: Always

ClientUserPolicy 

apiVersion: openidclient.keycloak.crossplane.io/v1alpha1
kind: ClientUserPolicy
metadata:
  name: my-user-policy
spec:
  providerConfigRef:
    name: "keycloak-provider-config"
  deletionPolicy: Delete
  forProvider:
    name: my-user-policy
    usersRefs:
      - name: "tim-tester"
        policy:
          resolve: Always
    decisionStrategy: UNANIMOUS
    logic: POSITIVE
    resourceServerIdRef:
      name: "test"
      policy:
        resolve: Always
    realmIdRef:
      name: "dev"
      policy:
        resolve: Always

ClientRegexPolicy 

apiVersion: openidclient.keycloak.crossplane.io/v1alpha1
kind: ClientRegexPolicy
metadata:
  name: regex-policy
spec:
  deletionPolicy: Delete
  forProvider:
    decisionStrategy: UNANIMOUS
    logic: POSITIVE
    name: regex-policy
    pattern: ^sample.+$
    realmIdRef:
      name: "dev"
      policy:
        resolve: Always
    resourceServerIdRef:
      name: "test"
      policy:
        resolve: Always
    targetClaim: sample-claim
  providerConfigRef:
    name: "keycloak-provider-config"

ClientPermissions 

apiVersion: openidclient.keycloak.crossplane.io/v1alpha1
kind: ClientPermissions
metadata:
  name: my-permission
spec:
  providerConfigRef:
    name: "keycloak-provider-config"
  deletionPolicy: Delete
  forProvider:
    clientIdRef:
      name: "test"
      policy:
        resolve: Always
    realmIdRef:
      name: "dev"
      policy:
        resolve: Always

Related Resources

Authentication FlowsClients