pedroigor · Apr 17, 2026 · Mar 30, 2026 · Apr 16, 2026 · Apr 16, 2026
@@ -1212,6 +1212,25 @@ jobs:
       - name: Run tests
         run: ./mvnw package -f scim/tests/pom.xml
 
+  authzen-integration-tests:
+    name: AuthZen IT
+    runs-on: ubuntu-latest
+    needs:
+      - build
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - id: integration-test-setup
+        name: Integration test setup
+        uses: ./.github/actions/integration-test-setup
+
+      - name: Build tar keycloak-quarkus-dist
+        run: ./mvnw package -pl quarkus/server/,quarkus/dist/
+
+      - name: Run tests
+        run: ./mvnw package -f authzen/tests/pom.xml
+
   admin-v2-tests:
     name: Admin v2
     if: needs.conditional.outputs.ci-admin-v2 == 'true'
@@ -1296,6 +1315,7 @@ jobs:
       - test-framework
       - base-new-integration-tests
       - mixed-cluster-compatibility-tests
+      - authzen-integration-tests
       - admin-v2-tests
       - testsuite-deprecation-check
     runs-on: ubuntu-latest

@@ -0,0 +1,21 @@
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>999.0.0-SNAPSHOT</version>
+        <relativePath>../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-authzen-parent</artifactId>
+    <packaging>pom</packaging>
+    <name>Keycloak AuthZen Parent</name>
+    <description>The parent module for AuthZen support in Keycloak</description>
+
+    <modules>
+        <module>services</module>
+        <module>tests</module>
+    </modules>
+</project>
@@ -0,0 +1,34 @@
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>keycloak-parent</artifactId>
+        <groupId>org.keycloak</groupId>
+        <version>999.0.0-SNAPSHOT</version>
+        <relativePath>../../pom.xml</relativePath>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>keycloak-authzen-services</artifactId>
+    <name>Keycloak AuthZen Services</name>
+    <description>This module provides the AuthZen resource endpoints</description>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-server-spi</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-server-spi-private</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.keycloak</groupId>
+            <artifactId>keycloak-services</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>jakarta.ws.rs</groupId>
+            <artifactId>jakarta.ws.rs-api</artifactId>
+        </dependency>
+    </dependencies>
+</project>
@@ -0,0 +1,85 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.authorization.authzen;
+
+import java.util.Map;
+
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.annotation.JsonValue;
+
+public final class AuthZen {
+
+    public static final String AUTHZEN_ACCESS_PATH = "access/v1";
+    public static final String EVALUATION_PATH = AUTHZEN_ACCESS_PATH + "/evaluation";
+
+    private AuthZen() {
+    }
+
+    public enum SubjectType {
+        CLIENT("client"),
+        USER("user");
+
+        private final String value;
+
+        SubjectType(String value) {
+            this.value = value;
+        }
+
+        @JsonValue
+        public String getValue() {
+            return value;
+        }
+
+        @JsonCreator
+        public static SubjectType fromValue(String value) {
+            for (SubjectType type : values()) {
+                if (type.value.equals(value)) {
+                    return type;
+                }
+            }
+            throw new IllegalArgumentException("Unsupported subject type: " + value);
+        }
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public record Subject(
+            @JsonProperty(required = true) SubjectType type,
+            @JsonProperty(required = true) String id,
+            Map<String, Object> properties) {}
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public record Resource(
+            @JsonProperty(required = true) String type,
+            @JsonProperty(required = true) String id,
+            Map<String, Object> properties) {}
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public record Action(String name) {}
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public record EvaluationRequest(
+            @JsonProperty(required = true) Subject subject,
+            @JsonProperty(required = true) Resource resource,
+            @JsonProperty(required = true) Action action,
+            Map<String, Object> context) {}
+
+    @JsonIgnoreProperties(ignoreUnknown = true)
+    public record EvaluationResponse(boolean decision) {}
+}
@@ -0,0 +1,38 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.authorization.authzen;
+
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.services.resource.RealmResourceProvider;
+
+public class AuthZenRealmResourceProvider implements RealmResourceProvider {
+
+    private final KeycloakSession session;
+
+    public AuthZenRealmResourceProvider(KeycloakSession session) {
+        this.session = session;
+    }
+
+    @Override
+    public Object getResource() {
+        return new AuthZenResource(session);
+    }
+
+    @Override
+    public void close() {
+    }
+}
@@ -0,0 +1,58 @@
+/*
+ * Copyright 2025 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.keycloak.authorization.authzen;
+
+import org.keycloak.Config;
+import org.keycloak.common.Profile;
+import org.keycloak.common.Profile.Feature;
+import org.keycloak.models.KeycloakSession;
+import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.provider.EnvironmentDependentProviderFactory;
+import org.keycloak.services.resource.RealmResourceProvider;
+import org.keycloak.services.resource.RealmResourceProviderFactory;
+
+public class AuthZenRealmResourceProviderFactory implements RealmResourceProviderFactory, EnvironmentDependentProviderFactory {
+
+    public static final String PROVIDER_ID = "authzen";
+
+    @Override
+    public RealmResourceProvider create(KeycloakSession session) {
+        return new AuthZenRealmResourceProvider(session);
+    }
+
+    @Override
+    public void init(Config.Scope config) {
+    }
+
+    @Override
+    public void postInit(KeycloakSessionFactory factory) {
+    }
+
+    @Override
+    public void close() {
+    }
+
+    @Override
+    public String getId() {
+        return PROVIDER_ID;
+    }
+
+    @Override
+    public boolean isSupported(Config.Scope config) {
+        return Profile.isFeatureEnabled(Feature.AUTHZEN);
+    }
+}