How to configure keycloak in apisix

[anjoy8]

Hi,Hope to get help.
I generated a token of keycloak, and the result after parsing is as follows:

Then, in the route of apisix, configure the keycloak plug-in:

Use this token to access this route. Unfortunately, there was an error:
{"error":"invalid_request","error_description":"Client does not support permissions"}

[juzhiyuan]

The error shown in your screenshot is not from Apache APISIX IMO 🤔 Here is the authz-keycloack doc https://apisix.apache.org/docs/apisix/plugins/authz-keycloak/

And @starsz could you help to have a check?

[starsz]

The error shown in your screenshot is not from Apache APISIX IMO 🤔 Here is the authz-keycloack doc https://apisix.apache.org/docs/apisix/plugins/authz-keycloak/

And @starsz could you help to have a check?

OK.Let me have a check

[starsz]

Hi @anjoy8.Please make sure you have enabled the Authorization in keycloak client.

It's in Client-Settings

[anjoy8]

Yes, I have configured it

[anjoy8]

Excuse me, do I need configuration here?
and how?

[starsz]

Excuse me, do I need configuration here? and how?

No, it's no need.

In your APISIX route, the audience is account.
And the client ID you have enabled Authorization is insurance_app ?

IMO, I think you should enable it in the account client.

[anjoy8]

cool! That's why, thank you very much.

By the way, what is the relationship between account and custom client(e.g. insurance_app)?
I find the account is generated by the system.

[starsz]

cool! That's why, thank you very much.

By the way, what is the relationship between account and custom client(e.g. insurance_app)? I find the account is generated by the system.

Haha. Maybe you can refer to the keycloak doc: https://www.keycloak.org/docs/latest/server_admin/#assembly-managing-clients_server_administration_guide