kayx23 opened a new pull request, #13932: URL: https://github.com/apache/apisix/pull/13932
### Description The `authz-keycloak` guide still used Keycloak 18.0.2, legacy bootstrap environment variables, screenshots from an older Admin Console, and a runnable Resource Owner Password Credentials example. This PR ports the current, validated guide from api7/docs#2374 to the Apache APISIX reference while adapting it to the Apache quickstart. Changes include: - update the walkthrough and screenshots for Keycloak 26.7.3 - rebuild the Keycloak Authorization Services setup around a service account, resource, scope, client-scope policy, and scope-based permission - retain dynamic path authorization and static permission examples across the Admin API, ADC, Gateway API, and APISIX CRDs - prevent the validated bearer token from reaching the sample upstream - replace the runnable Password Credentials tutorial with compatibility guidance and the RFC 9700 prohibition - clarify endpoint dependencies, policy-enforcement behavior, redirects, timeout units, and encrypted fields Validation: - tested APISIX 3.18.0 with Keycloak 26.7.3 using the current quickstart - verified dynamic and static configurations through the Admin API: allowed `200`, insufficient scope `403`, and missing token `401` - ran `adc lint` and `adc sync` for both dynamic and static configurations and repeated the allowed/denied requests - verified that the sample upstream does not receive the `Authorization` header - parsed all YAML and JSON examples and ran Markdownlint - source-validated the Gateway API and APISIX CRD manifests; no Kubernetes cluster was available for a runtime application test #### Which issue(s) this PR fixes: N/A. Follow-up to api7/docs#2374. ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [ ] I have added tests corresponding to this change (documentation-only change; commands were tested manually as described above) - [x] I have updated the documentation to reflect this change - [x] I have verified that this change is backward compatible -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
