Validate auth and enforce ACLs for HTTP-based Keycloak token requests. Ideal for answering nginx auth requests.
Because this is meant for non-interactive use, failures only return 403.
On success, these http headers are returned:
- REMOTE_USER: the
posix.usernameorupnorpreferred_usernamein the token (required) - X_UID: the
posix.uidin the token (optional) - X_GID: the
posix.gidin the token (optional)
UID and GID are useful for POSIX filesystem access, for example https://unix.stackexchange.com/a/489744.
Primary configuration is via environment variables:
- ISSUERS: the issuers, comma-separated
- AUDIENCE: the audience
- BASE_PATH: the base path of the server, before any authorized paths in the token