Summary
In this chapter, you learned about the different strategies you can choose from to authorize access to protected resources in your applications. By leveraging token-based authorization, applications should be able to introspect tokens – either locally or through the introspection endpoint – and use their claims to support different access control mechanisms, such as RBAC, GBAC, and ABAC, or use the scopes granted by users to the client application acting on their behalf.
You also learned that Keycloak can be used as a centralized authorization service to decouple authorization from applications, where access decisions are taken by Keycloak based on the resources and policies managed through the server.
In the next chapter, we are going to look at the main steps for running Keycloak in production.