Skip to content

Commit da18249

Browse files
ahus1ahus1
committed
Deploying to main from @ f5de36f4c40d8cf3733c81ad8cf6a8bc21e2e8d2 🚀
1 parent fbcc837 commit da18249

10 files changed

Lines changed: 430 additions & 25 deletions

File tree

‎2026/05/authzen-as-experimental-feature.html‎

Lines changed: 240 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,240 @@
1+
2+
<!doctype html>
3+
<html lang="en" prefix="og: https://ogp.me/ns#">
4+
<head>
5+
<script async src="https://www.googletagmanager.com/gtag/js?id=G-0J2P9316N6"></script>
6+
<script>
7+
window.dataLayer = window.dataLayer || [];
8+
function gtag(){dataLayer.push(arguments);}
9+
gtag('js', new Date());
10+
gtag('config', 'G-0J2P9316N6');
11+
</script>
12+
<meta charset="utf-8"/>
13+
<title>Keycloak experimental AuthZEN Support - Keycloak</title>
14+
<meta name="twitter:card" content="summary_large">
15+
<meta name="twitter:site" content="@keycloak">
16+
<meta property="og:site_name" content="Keycloak">
17+
<meta property="og:title" content="Keycloak experimental AuthZEN Support">
18+
<meta name="viewport" content="width=device-width, initial-scale=1.0">
19+
<meta name="description" property="og:description" content="Keycloak now implements AuthZEN Evaluation and Evaluations APIs">
20+
<meta name="author" content="Ryan Emerson">
21+
<meta name="keywords" content="sso,idm,openid connect,saml,kerberos,ldap">
22+
<link href="https://www.keycloak.org/resources/bootstrap/dist/css/bootstrap.min.css" rel="stylesheet">
23+
<link href="https://www.keycloak.org/resources/@fortawesome/fontawesome-free/css/all.min.css" rel="stylesheet">
24+
<link href="https://www.keycloak.org/resources/css/keycloak.css" rel="stylesheet">
25+
<link rel="canonical" href="https://www.keycloak.org/2026/05/authzen-as-experimental-feature">
26+
<meta property="og:url" content="https://www.keycloak.org/2026/05/authzen-as-experimental-feature">
27+
<link rel="icon" type="image/x-icon" href="https://www.keycloak.org/resources/favicon.ico">
28+
<link rel="icon" type="image/vnd.microsoft.icon" href="https://www.keycloak.org/resources/favicon.ico">
29+
<link rel="icon" type="image/svg+xml" href="https://www.keycloak.org/resources/favicon.svg">
30+
<link rel="alternate" type="application/rss+xml" title="Keycloak's Blog" href="https://www.keycloak.org/rss.xml">
31+
<script type="application/ld+json">
32+
{"@context":"https://schema.org/","@type":"BlogPosting","@id":"https://www.keycloak.org/2026/05/authzen-as-experimental-feature","headline":"Keycloak experimental AuthZEN Support","name":"Keycloak experimental AuthZEN Support","datePublished":"2026-05-20T08:00:00Z","inLanguage":"en","abstract":"Keycloak now implements AuthZEN Evaluation and Evaluations APIs","url":"https://www.keycloak.org/2026/05/authzen-as-experimental-feature","publisher":{"@type":"Organization","@id":"https://keycloak.org","name":"Keycloak"},"author":[{"@type":"Person","name":"Ryan Emerson"}]}
33+
</script></head>
34+
<body>
35+
36+
<header class="navbar navbar-expand-md bg-light shadow-sm">
37+
<nav class="container-xxl flex-wrap flex-md-no-wrap navbar-light" data-nosnippet>
38+
<a class="navbar-brand me-3 me-md-4 me-lg-5" href="https://www.keycloak.org/">
39+
<img style="aspect-ratio: 730/151" class="img-fluid" src="https://www.keycloak.org/resources/images/logo.svg" width="240" alt="Keycloak"/>
40+
</a>
41+
<a class="nav-link d-none d-sm-block d-md-none d-lg-block" href="https://github.com/keycloak/keycloak"><img src="https://www.keycloak.org/resources/images/stars-large.svg" style="height: 25px; aspect-ratio: 124/20" alt="GitHub stars"/></a>
42+
<button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target="#navbarCollapse" aria-controls="navbarCollapse" aria-expanded="false" aria-label="Toggle navigation">
43+
<span class="fa fa-bars fa-lg px-1 py-2"></span>
44+
</button>
45+
<div class="collapse navbar-collapse" id="navbarCollapse">
46+
<ul class="navbar-nav flex-row flex-wrap bd-navbar-nav pt-2 py-md-0">
47+
<li class="nav-item col-6 col-md-auto">
48+
<a class="nav-link " href="https://www.keycloak.org/guides">Guides</a>
49+
</li>
50+
<li class="nav-item col-6 col-md-auto">
51+
<a class="nav-link " href="https://www.keycloak.org/documentation">Docs</a>
52+
</li>
53+
<li class="nav-item col-6 col-md-auto">
54+
<a class="nav-link " href="https://www.keycloak.org/downloads">Downloads</a>
55+
</li>
56+
<li class="nav-item col-6 col-md-auto">
57+
<a class="nav-link " href="https://www.keycloak.org/community">Community</a>
58+
</li>
59+
<li class="nav-item col-6 col-md-auto">
60+
<a class="nav-link " href="https://www.keycloak.org/blog">Blog</a>
61+
</li>
62+
</ul>
63+
</div>
64+
<div class="d-block d-sm-none d-md-block d-lg-none text-center vw-100">
65+
<a class="nav-link d-inline p-0" href="https://github.com/keycloak/keycloak"><img src="https://www.keycloak.org/resources/images/stars-large.svg" style="height: 25px; aspect-ratio: 124/20" alt="GitHub stars"/></a>
66+
</div>
67+
</nav>
68+
</header>
69+
70+
71+
<div class="container mt-5 kc-article kc-asciidoc">
72+
<h1>Keycloak experimental AuthZEN Support</h1>
73+
<p class="blog-date text-muted">May 20 2026 by Ryan Emerson</p>
74+
75+
76+
<div class="paragraph">
77+
<p>We are excited to announce that from 26.7.0, Keycloak will include experimental support for the
78+
<a href="https://openid.net/specs/authorization-api-1_0.html">OpenID AuthZEN Authorization API 1.0</a> specification. This allows
79+
Keycloak to act as a <strong>Policy Decision Point (PDP)</strong>, exposing its authorization capabilities through a standardized API
80+
that any <strong>Policy Enforcement Point (PEP)</strong> can consume.</p>
81+
</div>
82+
<div class="paragraph">
83+
<p>You can try this now with the <a href="https://github.com/keycloak/keycloak/releases/tag/nightly">Keycloak nightly release</a>.</p>
84+
</div>
85+
<div class="sect1">
86+
<h2 id="_why_authzen"><a class="anchor" href="#_why_authzen"></a>Why AuthZEN?</h2>
87+
<div class="sectionbody">
88+
<div class="paragraph">
89+
<p>Authorization has long been fragmented, with competing systems defining their own protocols for answering the same
90+
fundamental question: <em>"Can this subject perform this action on this resource?"</em>.
91+
This means applications are tightly coupled to whichever authorization backend they choose, and swapping
92+
providers requires rewriting integration code.</p>
93+
</div>
94+
<div class="paragraph">
95+
<p>AuthZEN changes this by defining a single, vendor-neutral API between the component that <em>asks</em> (the PEP) and the component
96+
that <em>decides</em> (the PDP). It is, in many ways, what OpenID Connect did for authentication&#8201;&#8212;&#8201;but for authorization.</p>
97+
</div>
98+
<div class="paragraph">
99+
<p>With AuthZEN:</p>
100+
</div>
101+
<div class="ulist">
102+
<ul>
103+
<li>
104+
<p><strong>No more vendor lock-in</strong>&#8201;&#8212;&#8201;your application speaks one API regardless of the PDP behind it.</p>
105+
</li>
106+
<li>
107+
<p><strong>RBAC, ABAC, and ReBAC under one roof</strong>&#8201;&#8212;&#8201;different policy models can answer the same request format, enabling true interoperability across authorization paradigms.</p>
108+
</li>
109+
<li>
110+
<p><strong>Centralized, externalized authorization</strong>&#8201;&#8212;&#8201;policy logic lives in the PDP, not scattered across application code, making it easier to audit and update.</p>
111+
</li>
112+
<li>
113+
<p><strong>Simpler integration</strong>&#8201;&#8212;&#8201;a clean REST API with a minimal request/response model replaces complex, implementation-specific SDKs.</p>
114+
</li>
115+
</ul>
116+
</div>
117+
</div>
118+
</div>
119+
<div class="sect1">
120+
<h2 id="_a_growing_ecosystem"><a class="anchor" href="#_a_growing_ecosystem"></a>A growing ecosystem</h2>
121+
<div class="sectionbody">
122+
<div class="paragraph">
123+
<p><a href="https://authzen-interop.net">OpenID AuthZEN Interop</a> demonstrates that over a dozen independently-developed PDPs can be
124+
used interchangeably by the same PEP without changing a single line of application code. By adding AuthZEN support,
125+
Keycloak joins this ecosystem and lets you leverage your existing Keycloak policies through the same standardized API
126+
used by every other AuthZEN-compatible PDP.</p>
127+
</div>
128+
</div>
129+
</div>
130+
<div class="sect1">
131+
<h2 id="_how_it_works"><a class="anchor" href="#_how_it_works"></a>How it works</h2>
132+
<div class="sectionbody">
133+
<div class="paragraph">
134+
<p>The interaction between your application and Keycloak follows the standard PEP / PDP pattern defined by AuthZEN:</p>
135+
</div>
136+
<div class="imageblock text-center">
137+
<div class="content">
138+
<img src="https://www.keycloak.org/resources/images/blog/authzen-flow.png" alt="AuthZEN PEP/PDP interaction flow" width="800">
139+
</div>
140+
</div>
141+
<div class="olist arabic">
142+
<ol class="arabic">
143+
<li>
144+
<p><strong>Your application (the PEP)</strong> sends an authorization request to Keycloak over the AuthZEN Evaluation API, identifying a subject, an action, and a resource.</p>
145+
</li>
146+
<li>
147+
<p><strong>Keycloak (the PDP)</strong> evaluates the request against its configured authorization policies and returns a simple decision: <code>true</code> or <code>false</code>.</p>
148+
</li>
149+
<li>
150+
<p><strong>Your application</strong> enforces the decision&#8201;&#8212;&#8201;granting or denying access accordingly.</p>
151+
</li>
152+
</ol>
153+
</div>
154+
<div class="paragraph">
155+
<p>Keycloak also supports the <strong>Evaluations API</strong> for batching multiple authorization checks into a single request, reducing
156+
round-trips when your application needs to check several permissions at once.</p>
157+
</div>
158+
</div>
159+
</div>
160+
<div class="sect1">
161+
<h2 id="_a_quick_walkthrough"><a class="anchor" href="#_a_quick_walkthrough"></a>A quick walkthrough</h2>
162+
<div class="sectionbody">
163+
<div class="paragraph">
164+
<p>Getting started takes just a few steps:</p>
165+
</div>
166+
<div class="olist arabic">
167+
<ol class="arabic">
168+
<li>
169+
<p><strong>Start Keycloak</strong> with the <code>authzen</code> feature enabled.</p>
170+
</li>
171+
<li>
172+
<p><strong>Configure a realm</strong> with users, roles, and an authorization-enabled client that defines your resources, scopes, and policies.</p>
173+
</li>
174+
<li>
175+
<p><strong>Discover the endpoints</strong> by querying the <code>.well-known/authzen-configuration</code> path for your realm&#8201;&#8212;&#8201;this returns the Evaluation and Evaluations API URLs so your PEP does not need to hardcode them.</p>
176+
</li>
177+
<li>
178+
<p><strong>Obtain an access token</strong> for the authorization-enabled client using a standard OAuth2 client credentials grant.</p>
179+
</li>
180+
<li>
181+
<p><strong>Send an evaluation request</strong> with a subject, action, and resource&#8201;&#8212;&#8201;Keycloak returns <code>{"decision": true}</code> or <code>{"decision": false}</code>.</p>
182+
</li>
183+
</ol>
184+
</div>
185+
<div class="paragraph">
186+
<p>Keycloak supports looking up subjects by username, UUID, or email, giving your PEP flexibility in how it identifies users.</p>
187+
</div>
188+
</div>
189+
</div>
190+
<div class="sect1">
191+
<h2 id="_try_it_out"><a class="anchor" href="#_try_it_out"></a>Try it out</h2>
192+
<div class="sectionbody">
193+
<div class="paragraph">
194+
<p><a href="https://www.keycloak.org/nightly/securing-apps/authzen-authorization">Feature documentation is available in the nightly build of the docs</a>.</p>
195+
</div>
196+
<div class="paragraph">
197+
<p>We have also prepared a hands-on playground that walks you through the full setup with working examples of both the Evaluation
198+
and Evaluations API:</p>
199+
</div>
200+
<div class="ulist">
201+
<ul>
202+
<li>
203+
<p><a href="https://github.com/keycloak/keycloak-playground/tree/main/authzen"><strong>Keycloak AuthZEN Playground on GitHub</strong></a></p>
204+
</li>
205+
</ul>
206+
</div>
207+
</div>
208+
</div>
209+
<div class="sect1">
210+
<h2 id="_feedback_welcome"><a class="anchor" href="#_feedback_welcome"></a>Feedback welcome</h2>
211+
<div class="sectionbody">
212+
<div class="paragraph">
213+
<p>AuthZEN support in Keycloak is currently an <strong>experimental feature</strong>, and we would love to hear from the community as
214+
we shape its future. Download the <a href="https://github.com/keycloak/keycloak/releases/tag/nightly">Keycloak nightly release</a> and
215+
try it out.</p>
216+
</div>
217+
<div class="paragraph">
218+
<p>Please share your experiences, suggestions, and feature requests on the
219+
<a href="https://github.com/keycloak/keycloak/discussions/46012">AuthZEN GitHub discussion</a> or join the conversation on the
220+
<a href="https://groups.google.com/g/keycloak-dev">Keycloak mailing list</a>. Your input will directly influence how we evolve
221+
AuthZEN support in future releases.</p>
222+
</div>
223+
</div>
224+
</div></div>
225+
226+
227+
<div class="container mt-5" data-nosnippet>
228+
<footer class="py-3 my-4 border-top">
229+
<p class="text-center text-muted">Keycloak is a Cloud Native Computing Foundation incubation project</p>
230+
<div class="text-center">
231+
<img style="aspect-ratio: 300/48" alt="Cloud Native Computing Foundation" src="https://www.keycloak.org/resources/images/cncf_logo.png" loading="lazy"/>
232+
</div>
233+
<p class="mt-4 text-center small text-muted">&copy; Keycloak Authors 2026. &copy; 2026 The Linux Foundation. All rights reserved. The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see our <a href="https://www.linuxfoundation.org/trademark-usage">Trademark Usage page</a>.</p>
234+
</footer>
235+
</div>
236+
237+
<script src="https://www.keycloak.org/resources/bootstrap/dist/js/bootstrap.min.js" type="text/javascript"></script>
238+
<script src="https://www.keycloak.org/resources/tocbot/dist/tocbot.min.js" type="text/javascript"></script>
239+
</body>
240+
</html>

‎blog-archive.html‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,11 @@ <h2>2026</h2>
8686

8787
<h3>May</h3>
8888

89+
<ul>
90+
<li><a href="https://www.keycloak.org/2026/05/authzen-as-experimental-feature">Keycloak experimental AuthZEN Support</a></li>
91+
</ul>
92+
93+
8994
<ul>
9095
<li><a href="https://www.keycloak.org/2026/05/keycloak-2662-released">Keycloak 26.6.2 released</a></li>
9196
</ul>

‎blog.html‎

Lines changed: 17 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,23 @@
6868
<div class="jumbotron jumbotron-fluid bg-light kc-bg-triangles pt-4 pb-2">
6969
<div class="container">
7070
<div class="row">
71+
<div class="col-sm-6">
72+
<div class="card shadow-sm mb-4">
73+
<div class="card-body">
74+
<h4 class="card-title" >
75+
Keycloak experimental AuthZEN Support
76+
</h4>
77+
<div class="card-text">Keycloak now implements AuthZEN Evaluation and Evaluations APIs</div>
78+
<a href="https://www.keycloak.org/2026/05/authzen-as-experimental-feature" class="stretched-link link-dark"></a>
79+
</div>
80+
<div class="card-footer align-items-center d-flex">
81+
<span class="card-subtitle fs-xsmall text-muted">
82+
20 May 2026
83+
by Ryan Emerson
84+
</span>
85+
</div>
86+
</div>
87+
</div>
7188
<div class="col-sm-6">
7289
<div class="card shadow-sm mb-4">
7390
<div class="card-body">
@@ -185,22 +202,6 @@ <h4 class="card-title" style="margin-bottom:0">
185202
</div>
186203
</div>
187204
</div>
188-
<div class="col-sm-6">
189-
<div class="card shadow-sm mb-4">
190-
<div class="card-body">
191-
<h4 class="card-title" style="margin-bottom:0">
192-
Keycloak 26.6.1 released
193-
</h4>
194-
<a href="https://www.keycloak.org/2026/04/keycloak-2661-released" class="stretched-link link-dark"></a>
195-
</div>
196-
<div class="card-footer align-items-center d-flex">
197-
<span class="card-subtitle fs-xsmall text-muted">
198-
15 April 2026
199-
200-
</span>
201-
</div>
202-
</div>
203-
</div>
204205
</div>
205206
<div class="row">
206207
<div class="col">

‎extensions.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -245,7 +245,7 @@ <h5 class="card-title">EDP Keycloak Operator</h5>
245245
<div class="d-flex align-items-center">
246246
<img src="resources/images/github.png" width="16px" alt="GitHub logo"
247247
class="me-2"/>
248-
<span data-nosnippet>87 stars</span>
248+
<span data-nosnippet>88 stars</span>
249249
</div>
250250
</div>
251251
</div>

‎index.html‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -93,13 +93,13 @@ <h1 class="display-3 fw-bold">Identity and Access Management</h1>
9393
<div class="row kc-news-section">
9494
<div class="col-md-1 col-sm-12 fw-bold justify-content-center kc-news-item"><a href="https://www.keycloak.org/blog">News</a></div>
9595
<div class="col kc-news-item">
96-
<span class="badge bg-secondary">19 May</span> <a href="https://www.keycloak.org/2026/05/keycloak-2662-released">Keycloak 26.6.2 released</a>
96+
<span class="badge bg-secondary">20 May</span> <a href="https://www.keycloak.org/2026/05/authzen-as-experimental-feature">Keycloak experimental AuthZEN Support</a>
9797
</div>
9898
<div class="col kc-news-item">
99-
<span class="badge bg-secondary">07 May</span> <a href="https://www.keycloak.org/2026/05/new-maintainer-ricardo">New Keycloak Maintainer: Ricardo Martin</a>
99+
<span class="badge bg-secondary">19 May</span> <a href="https://www.keycloak.org/2026/05/keycloak-2662-released">Keycloak 26.6.2 released</a>
100100
</div>
101101
<div class="col kc-news-item">
102-
<span class="badge bg-secondary">07 May</span> <a href="https://www.keycloak.org/2026/05/org-fgap">Fine-Grained Admin Permissions for Organizations</a>
102+
<span class="badge bg-secondary">07 May</span> <a href="https://www.keycloak.org/2026/05/new-maintainer-ricardo">New Keycloak Maintainer: Ricardo Martin</a>
103103
</div>
104104
</div>
105105
</div>

‎resources/images/blog/authzen-flow.png‎

19.6 KB
Loading

0 commit comments

Comments
 (0)