Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Keycloak Provider
  4. API Docs
  5. GenericClientAuthorizationPolicy
Viewing docs for Keycloak v6.13.0
published on Saturday, Aug 1, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-keycloak

keycloak.GenericClientAuthorizationPolicy

keycloak logo keycloak logo
Viewing docs for Keycloak v6.13.0
published on Saturday, Aug 1, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-keycloak

    Allows you to manage a Keycloak client authorization policy of any provider type by referencing that provider by its type. This is the policy equivalent of keycloak.GenericRoleMapper / keycloak.GenericProtocolMapper: it works with any policy provider registered in Keycloak, including custom providers you implement yourself.

    This is intended for custom policy providers that are deployed to Keycloak as a JAR. The type is simply the provider id that the policy’s PolicyProviderFactory exposes via getId():

    • For a policy implemented in Java as an SPI, type is whatever your PolicyProviderFactory.getId() returns.
    • For a JavaScript policy deployed as a script (in a JAR with a META-INF/keycloak-scripts.json descriptor), Keycloak generates the provider id for you as script- followed by the fileName from the descriptor (if the fileName contains a path, it is kept). The script- prefix is an implementation detail of the scripting SPI, not a requirement of this resource. For example, "fileName": "my-policy.js" is referenced as type = "script-my-policy.js". (Modern Keycloak no longer allows uploading the JavaScript code through the API, so the script must be deployed alongside Keycloak and only referenced here.)

    For the policy types that ship with Keycloak (role, group, user, client, time, regex, …) prefer the dedicated resources, e.g. keycloak.openid.ClientRolePolicy.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as keycloak from "@pulumi/keycloak";

const realm = new keycloak.Realm("realm", {
    realm: "my-realm",
    enabled: true,
});
const test = new keycloak.openid.Client("test", {
    clientId: "client_id",
    realmId: realm.id,
    accessType: "CONFIDENTIAL",
    serviceAccountsEnabled: true,
    authorization: {
        policyEnforcementMode: "ENFORCING",
    },
});
// References a custom policy provider implemented in Java and deployed as a JAR.
// "type" is the id returned by your PolicyProviderFactory.getId().
const custom = new keycloak.GenericClientAuthorizationPolicy("custom", {
    resourceServerId: test.resourceServerId,
    realmId: realm.id,
    name: "my-custom-policy",
    type: "my-custom-policy-provider",
    decisionStrategy: "UNANIMOUS",
    logic: "POSITIVE",
    description: "Authorization policy backed by a custom Java SPI provider",
});
// References a JavaScript policy deployed as a script. Here Keycloak generates the
// type as "script-" + the fileName from META-INF/keycloak-scripts.json.
const deployedJs = new keycloak.GenericClientAuthorizationPolicy("deployed_js", {
    resourceServerId: test.resourceServerId,
    realmId: realm.id,
    name: "deployed-js-policy",
    type: "script-my-policy.js",
    decisionStrategy: "UNANIMOUS",
    logic: "POSITIVE",
    description: "Authorization policy backed by a deployed JavaScript script",
});

    import pulumi
import pulumi_keycloak as keycloak

realm = keycloak.Realm("realm",
    realm="my-realm",
    enabled=True)
test = keycloak.openid.Client("test",
    client_id="client_id",
    realm_id=realm.id,
    access_type="CONFIDENTIAL",
    service_accounts_enabled=True,
    authorization={
        "policy_enforcement_mode": "ENFORCING",
    })
# References a custom policy provider implemented in Java and deployed as a JAR.
# "type" is the id returned by your PolicyProviderFactory.getId().
custom = keycloak.GenericClientAuthorizationPolicy("custom",
    resource_server_id=test.resource_server_id,
    realm_id=realm.id,
    name="my-custom-policy",
    type="my-custom-policy-provider",
    decision_strategy="UNANIMOUS",
    logic="POSITIVE",
    description="Authorization policy backed by a custom Java SPI provider")
# References a JavaScript policy deployed as a script. Here Keycloak generates the
# type as "script-" + the fileName from META-INF/keycloak-scripts.json.
deployed_js = keycloak.GenericClientAuthorizationPolicy("deployed_js",
    resource_server_id=test.resource_server_id,
    realm_id=realm.id,
    name="deployed-js-policy",
    type="script-my-policy.js",
    decision_strategy="UNANIMOUS",
    logic="POSITIVE",
    description="Authorization policy backed by a deployed JavaScript script")

    package main

import (
	"github.com/pulumi/pulumi-keycloak/sdk/v6/go/keycloak"
	"github.com/pulumi/pulumi-keycloak/sdk/v6/go/keycloak/openid"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		realm, err := keycloak.NewRealm(ctx, "realm", &keycloak.RealmArgs{
			Realm:   pulumi.String("my-realm"),
			Enabled: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		test, err := openid.NewClient(ctx, "test", &openid.ClientArgs{
			ClientId:               pulumi.String("client_id"),
			RealmId:                realm.ID(),
			AccessType:             pulumi.String("CONFIDENTIAL"),
			ServiceAccountsEnabled: pulumi.Bool(true),
			Authorization: &openid.ClientAuthorizationArgs{
				PolicyEnforcementMode: pulumi.String("ENFORCING"),
			},
		})
		if err != nil {
			return err
		}
		// References a custom policy provider implemented in Java and deployed as a JAR.
		// "type" is the id returned by your PolicyProviderFactory.getId().
		_, err = keycloak.NewGenericClientAuthorizationPolicy(ctx, "custom", &keycloak.GenericClientAuthorizationPolicyArgs{
			ResourceServerId: test.ResourceServerId,
			RealmId:          realm.ID(),
			Name:             pulumi.String("my-custom-policy"),
			Type:             pulumi.String("my-custom-policy-provider"),
			DecisionStrategy: pulumi.String("UNANIMOUS"),
			Logic:            pulumi.String("POSITIVE"),
			Description:      pulumi.String("Authorization policy backed by a custom Java SPI provider"),
		})
		if err != nil {
			return err
		}
		// References a JavaScript policy deployed as a script. Here Keycloak generates the
		// type as "script-" + the fileName from META-INF/keycloak-scripts.json.
		_, err = keycloak.NewGenericClientAuthorizationPolicy(ctx, "deployed_js", &keycloak.GenericClientAuthorizationPolicyArgs{
			ResourceServerId: test.ResourceServerId,
			RealmId:          realm.ID(),
			Name:             pulumi.String("deployed-js-policy"),
			Type:             pulumi.String("script-my-policy.js"),
			DecisionStrategy: pulumi.String("UNANIMOUS"),
			Logic:            pulumi.String("POSITIVE"),
			Description:      pulumi.String("Authorization policy backed by a deployed JavaScript script"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Keycloak = Pulumi.Keycloak;

return await Deployment.RunAsync(() => 
{
    var realm = new Keycloak.Realm("realm", new()
    {
        RealmName = "my-realm",
        Enabled = true,
    });

    var test = new Keycloak.OpenId.Client("test", new()
    {
        ClientId = "client_id",
        RealmId = realm.Id,
        AccessType = "CONFIDENTIAL",
        ServiceAccountsEnabled = true,
        Authorization = new Keycloak.OpenId.Inputs.ClientAuthorizationArgs
        {
            PolicyEnforcementMode = "ENFORCING",
        },
    });

    // References a custom policy provider implemented in Java and deployed as a JAR.
    // "type" is the id returned by your PolicyProviderFactory.getId().
    var custom = new Keycloak.GenericClientAuthorizationPolicy("custom", new()
    {
        ResourceServerId = test.ResourceServerId,
        RealmId = realm.Id,
        Name = "my-custom-policy",
        Type = "my-custom-policy-provider",
        DecisionStrategy = "UNANIMOUS",
        Logic = "POSITIVE",
        Description = "Authorization policy backed by a custom Java SPI provider",
    });

    // References a JavaScript policy deployed as a script. Here Keycloak generates the
    // type as "script-" + the fileName from META-INF/keycloak-scripts.json.
    var deployedJs = new Keycloak.GenericClientAuthorizationPolicy("deployed_js", new()
    {
        ResourceServerId = test.ResourceServerId,
        RealmId = realm.Id,
        Name = "deployed-js-policy",
        Type = "script-my-policy.js",
        DecisionStrategy = "UNANIMOUS",
        Logic = "POSITIVE",
        Description = "Authorization policy backed by a deployed JavaScript script",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.keycloak.Realm;
import com.pulumi.keycloak.RealmArgs;
import com.pulumi.keycloak.openid.Client;
import com.pulumi.keycloak.openid.ClientArgs;
import com.pulumi.keycloak.openid.inputs.ClientAuthorizationArgs;
import com.pulumi.keycloak.GenericClientAuthorizationPolicy;
import com.pulumi.keycloak.GenericClientAuthorizationPolicyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var realm = new Realm("realm", RealmArgs.builder()
            .realm("my-realm")
            .enabled(true)
            .build());

        var test = new Client("test", ClientArgs.builder()
            .clientId("client_id")
            .realmId(realm.id())
            .accessType("CONFIDENTIAL")
            .serviceAccountsEnabled(true)
            .authorization(ClientAuthorizationArgs.builder()
                .policyEnforcementMode("ENFORCING")
                .build())
            .build());

        // References a custom policy provider implemented in Java and deployed as a JAR.
        // "type" is the id returned by your PolicyProviderFactory.getId().
        var custom = new GenericClientAuthorizationPolicy("custom", GenericClientAuthorizationPolicyArgs.builder()
            .resourceServerId(test.resourceServerId())
            .realmId(realm.id())
            .name("my-custom-policy")
            .type("my-custom-policy-provider")
            .decisionStrategy("UNANIMOUS")
            .logic("POSITIVE")
            .description("Authorization policy backed by a custom Java SPI provider")
            .build());

        // References a JavaScript policy deployed as a script. Here Keycloak generates the
        // type as "script-" + the fileName from META-INF/keycloak-scripts.json.
        var deployedJs = new GenericClientAuthorizationPolicy("deployedJs", GenericClientAuthorizationPolicyArgs.builder()
            .resourceServerId(test.resourceServerId())
            .realmId(realm.id())
            .name("deployed-js-policy")
            .type("script-my-policy.js")
            .decisionStrategy("UNANIMOUS")
            .logic("POSITIVE")
            .description("Authorization policy backed by a deployed JavaScript script")
            .build());

    }
}

    resources:
  realm:
    type: keycloak:Realm
    properties:
      realm: my-realm
      enabled: true
  test:
    type: keycloak:openid:Client
    properties:
      clientId: client_id
      realmId: ${realm.id}
      accessType: CONFIDENTIAL
      serviceAccountsEnabled: true
      authorization:
        policyEnforcementMode: ENFORCING
  # References a custom policy provider implemented in Java and deployed as a JAR.
  # "type" is the id returned by your PolicyProviderFactory.getId().
  custom:
    type: keycloak:GenericClientAuthorizationPolicy
    properties:
      resourceServerId: ${test.resourceServerId}
      realmId: ${realm.id}
      name: my-custom-policy
      type: my-custom-policy-provider
      decisionStrategy: UNANIMOUS
      logic: POSITIVE
      description: Authorization policy backed by a custom Java SPI provider
  # References a JavaScript policy deployed as a script. Here Keycloak generates the
  # type as "script-" + the fileName from META-INF/keycloak-scripts.json.
  deployedJs:
    type: keycloak:GenericClientAuthorizationPolicy
    name: deployed_js
    properties:
      resourceServerId: ${test.resourceServerId}
      realmId: ${realm.id}
      name: deployed-js-policy
      type: script-my-policy.js
      decisionStrategy: UNANIMOUS
      logic: POSITIVE
      description: Authorization policy backed by a deployed JavaScript script

    pulumi {
  required_providers {
    keycloak = {
      source = "pulumi/keycloak"
    }
  }
}

resource "keycloak_realm" "realm" {
  realm   = "my-realm"
  enabled = true
}
resource "keycloak_openid_client" "test" {
  client_id                = "client_id"
  realm_id                 = keycloak_realm.realm.id
  access_type              = "CONFIDENTIAL"
  service_accounts_enabled = true
  authorization = {
    policy_enforcement_mode = "ENFORCING"
  }
}
# References a custom policy provider implemented in Java and deployed as a JAR.
# "type" is the id returned by your PolicyProviderFactory.getId().
resource "keycloak_genericclientauthorizationpolicy" "custom" {
  resource_server_id = keycloak_openid_client.test.resource_server_id
  realm_id           = keycloak_realm.realm.id
  name               = "my-custom-policy"
  type               = "my-custom-policy-provider"
  decision_strategy  = "UNANIMOUS"
  logic              = "POSITIVE"
  description        = "Authorization policy backed by a custom Java SPI provider"
}
# References a JavaScript policy deployed as a script. Here Keycloak generates the
# type as "script-" + the fileName from META-INF/keycloak-scripts.json.
resource "keycloak_genericclientauthorizationpolicy" "deployed_js" {
  resource_server_id = keycloak_openid_client.test.resource_server_id
  realm_id           = keycloak_realm.realm.id
  name               = "deployed-js-policy"
  type               = "script-my-policy.js"
  decision_strategy  = "UNANIMOUS"
  logic              = "POSITIVE"
  description        = "Authorization policy backed by a deployed JavaScript script"
}

    Create GenericClientAuthorizationPolicy Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new GenericClientAuthorizationPolicy(name: string, args: GenericClientAuthorizationPolicyArgs, opts?: CustomResourceOptions);
    @overload
def GenericClientAuthorizationPolicy(resource_name: str,
                                     args: GenericClientAuthorizationPolicyArgs,
                                     opts: Optional[ResourceOptions] = None)

@overload
def GenericClientAuthorizationPolicy(resource_name: str,
                                     opts: Optional[ResourceOptions] = None,
                                     decision_strategy: Optional[str] = None,
                                     realm_id: Optional[str] = None,
                                     resource_server_id: Optional[str] = None,
                                     type: Optional[str] = None,
                                     description: Optional[str] = None,
                                     logic: Optional[str] = None,
                                     name: Optional[str] = None)
    func NewGenericClientAuthorizationPolicy(ctx *Context, name string, args GenericClientAuthorizationPolicyArgs, opts ...ResourceOption) (*GenericClientAuthorizationPolicy, error)
    public GenericClientAuthorizationPolicy(string name, GenericClientAuthorizationPolicyArgs args, CustomResourceOptions? opts = null)
    public GenericClientAuthorizationPolicy(String name, GenericClientAuthorizationPolicyArgs args)
public GenericClientAuthorizationPolicy(String name, GenericClientAuthorizationPolicyArgs args, CustomResourceOptions options)

    type: keycloak:GenericClientAuthorizationPolicy
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "keycloak_generic_client_authorization_policy" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args GenericClientAuthorizationPolicyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args GenericClientAuthorizationPolicyArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args GenericClientAuthorizationPolicyArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args GenericClientAuthorizationPolicyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args GenericClientAuthorizationPolicyArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var genericClientAuthorizationPolicyResource = new Keycloak.GenericClientAuthorizationPolicy("genericClientAuthorizationPolicyResource", new()
{
    DecisionStrategy = "string",
    RealmId = "string",
    ResourceServerId = "string",
    Type = "string",
    Description = "string",
    Logic = "string",
    Name = "string",
});

    example, err := keycloak.NewGenericClientAuthorizationPolicy(ctx, "genericClientAuthorizationPolicyResource", &keycloak.GenericClientAuthorizationPolicyArgs{
	DecisionStrategy: pulumi.String("string"),
	RealmId:          pulumi.String("string"),
	ResourceServerId: pulumi.String("string"),
	Type:             pulumi.String("string"),
	Description:      pulumi.String("string"),
	Logic:            pulumi.String("string"),
	Name:             pulumi.String("string"),
})

    resource "keycloak_generic_client_authorization_policy" "genericClientAuthorizationPolicyResource" {
  lifecycle {
    create_before_destroy = true
  }
  decision_strategy  = "string"
  realm_id           = "string"
  resource_server_id = "string"
  type               = "string"
  description        = "string"
  logic              = "string"
  name               = "string"
}

    var genericClientAuthorizationPolicyResource = new GenericClientAuthorizationPolicy("genericClientAuthorizationPolicyResource", GenericClientAuthorizationPolicyArgs.builder()
    .decisionStrategy("string")
    .realmId("string")
    .resourceServerId("string")
    .type("string")
    .description("string")
    .logic("string")
    .name("string")
    .build());

    generic_client_authorization_policy_resource = keycloak.GenericClientAuthorizationPolicy("genericClientAuthorizationPolicyResource",
    decision_strategy="string",
    realm_id="string",
    resource_server_id="string",
    type="string",
    description="string",
    logic="string",
    name="string")

    const genericClientAuthorizationPolicyResource = new keycloak.GenericClientAuthorizationPolicy("genericClientAuthorizationPolicyResource", {
    decisionStrategy: "string",
    realmId: "string",
    resourceServerId: "string",
    type: "string",
    description: "string",
    logic: "string",
    name: "string",
});

    type: keycloak:GenericClientAuthorizationPolicy
properties:
    decisionStrategy: string
    description: string
    logic: string
    name: string
    realmId: string
    resourceServerId: string
    type: string

    GenericClientAuthorizationPolicy Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The GenericClientAuthorizationPolicy resource accepts the following input properties:

    DecisionStrategy string
    The decision strategy, can be one of UNANIMOUS, AFFIRMATIVE, or CONSENSUS.
    RealmId string
    The realm this policy exists in.
    ResourceServerId string
    The ID of the resource server this policy is attached to.
    Type string
    The provider type of the policy, i.e. the id returned by the policy's PolicyProviderFactory.getId(). For a custom Java SPI this is whatever id your factory exposes; for a JavaScript policy deployed as a script it is script- followed by the fileName declared in META-INF/keycloak-scripts.json, e.g. script-my-policy.js.
    Description string
    A description for the authorization policy.
    Logic string
    The logic, can be one of POSITIVE or NEGATIVE. Defaults to POSITIVE.
    Name string
    The name of the policy.
    DecisionStrategy string
    The decision strategy, can be one of UNANIMOUS, AFFIRMATIVE, or CONSENSUS.
    RealmId string
    The realm this policy exists in.
    ResourceServerId string
    The ID of the resource server this policy is attached to.
    Type string
    The provider type of the policy, i.e. the id returned by the policy's PolicyProviderFactory.getId(). For a custom Java SPI this is whatever id your factory exposes; for a JavaScript policy deployed as a script it is script- followed by the fileName declared in META-INF/keycloak-scripts.json, e.g. script-my-policy.js.
    Description string
    A description for the authorization policy.
    Logic string
    The logic, can be one of POSITIVE or NEGATIVE. Defaults to POSITIVE.
    Name string
    The name of the policy.
    decision_strategy string
    The decision strategy, can be one of UNANIMOUS, AFFIRMATIVE, or CONSENSUS.
    realm_id string
    The realm this policy exists in.
    resource_server_id string
    The ID of the resource server this policy is attached to.
    type string
    The provider type of the policy, i.e. the id returned by the policy's PolicyProviderFactory.getId(). For a custom Java SPI this is whatever id your factory exposes; for a JavaScript policy deployed as a script it is script- followed by the fileName declared in META-INF/keycloak-scripts.json, e.g. script-my-policy.js.
    description string
    A description for the authorization policy.
    logic string
    The logic, can be one of POSITIVE or NEGATIVE. Defaults to POSITIVE.
    name string
    The name of the policy.
    decisionStrategy String
    The decision strategy, can be one of UNANIMOUS, AFFIRMATIVE, or CONSENSUS.
    realmId String
    The realm this policy exists in.
    resourceServerId String
    The ID of the resource server this policy is attached to.
    type String
    The provider type of the policy, i.e. the id returned by the policy's PolicyProviderFactory.getId(). For a custom Java SPI this is whatever id your factory exposes; for a JavaScript policy deployed as a script it is script- followed by the fileName declared in META-INF/keycloak-scripts.json, e.g. script-my-policy.js.
    description String
    A description for the authorization policy.
    logic String
    The logic, can be one of POSITIVE or NEGATIVE. Defaults to POSITIVE.
    name String
    The name of the policy.
    decisionStrategy string
    The decision strategy, can be one of UNANIMOUS, AFFIRMATIVE, or CONSENSUS.
    realmId string
    The realm this policy exists in.
    resourceServerId string
    The ID of the resource server this policy is attached to.
    type string
    The provider type of the policy, i.e. the id returned by the policy's PolicyProviderFactory.getId(). For a custom Java SPI this is whatever id your factory exposes; for a JavaScript policy deployed as a script it is script- followed by the fileName declared in META-INF/keycloak-scripts.json, e.g. script-my-policy.js.
    description string
    A description for the authorization policy.
    logic string
    The logic, can be one of POSITIVE or NEGATIVE. Defaults to POSITIVE.
    name string
    The name of the policy.
    decision_strategy str
    The decision strategy, can be one of UNANIMOUS, AFFIRMATIVE, or CONSENSUS.
    realm_id str
    The realm this policy exists in.
    resource_server_id str
    The ID of the resource server this policy is attached to.
    type str
    The provider type of the policy, i.e. the id returned by the policy's PolicyProviderFactory.getId(). For a custom Java SPI this is whatever id your factory exposes; for a JavaScript policy deployed as a script it is script- followed by the fileName declared in META-INF/keycloak-scripts.json, e.g. script-my-policy.js.
    description str
    A description for the authorization policy.
    logic str
    The logic, can be one of POSITIVE or NEGATIVE. Defaults to POSITIVE.
    name str
    The name of the policy.
    decisionStrategy String
    The decision strategy, can be one of UNANIMOUS, AFFIRMATIVE, or CONSENSUS.
    realmId String
    The realm this policy exists in.
    resourceServerId String
    The ID of the resource server this policy is attached to.
    type String
    The provider type of the policy, i.e. the id returned by the policy's PolicyProviderFactory.getId(). For a custom Java SPI this is whatever id your factory exposes; for a JavaScript policy deployed as a script it is script- followed by the fileName declared in META-INF/keycloak-scripts.json, e.g. script-my-policy.js.
    description String
    A description for the authorization policy.
    logic String
    The logic, can be one of POSITIVE or NEGATIVE. Defaults to POSITIVE.
    name String
    The name of the policy.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the GenericClientAuthorizationPolicy resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing GenericClientAuthorizationPolicy Resource

    Get an existing GenericClientAuthorizationPolicy resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: GenericClientAuthorizationPolicyState, opts?: CustomResourceOptions): GenericClientAuthorizationPolicy
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        decision_strategy: Optional[str] = None,
        description: Optional[str] = None,
        logic: Optional[str] = None,
        name: Optional[str] = None,
        realm_id: Optional[str] = None,
        resource_server_id: Optional[str] = None,
        type: Optional[str] = None) -> GenericClientAuthorizationPolicy
    func GetGenericClientAuthorizationPolicy(ctx *Context, name string, id IDInput, state *GenericClientAuthorizationPolicyState, opts ...ResourceOption) (*GenericClientAuthorizationPolicy, error)
    public static GenericClientAuthorizationPolicy Get(string name, Input<string> id, GenericClientAuthorizationPolicyState? state, CustomResourceOptions? opts = null)
    public static GenericClientAuthorizationPolicy get(String name, Output<String> id, GenericClientAuthorizationPolicyState state, CustomResourceOptions options)
    resources:  _:    type: keycloak:GenericClientAuthorizationPolicy    get:      id: ${id}
    import {
  to = keycloak_generic_client_authorization_policy.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    DecisionStrategy string
    The decision strategy, can be one of UNANIMOUS, AFFIRMATIVE, or CONSENSUS.
    Description string
    A description for the authorization policy.
    Logic string
    The logic, can be one of POSITIVE or NEGATIVE. Defaults to POSITIVE.
    Name string
    The name of the policy.
    RealmId string
    The realm this policy exists in.
    ResourceServerId string
    The ID of the resource server this policy is attached to.
    Type string
    The provider type of the policy, i.e. the id returned by the policy's PolicyProviderFactory.getId(). For a custom Java SPI this is whatever id your factory exposes; for a JavaScript policy deployed as a script it is script- followed by the fileName declared in META-INF/keycloak-scripts.json, e.g. script-my-policy.js.
    DecisionStrategy string
    The decision strategy, can be one of UNANIMOUS, AFFIRMATIVE, or CONSENSUS.
    Description string
    A description for the authorization policy.
    Logic string
    The logic, can be one of POSITIVE or NEGATIVE. Defaults to POSITIVE.
    Name string
    The name of the policy.
    RealmId string
    The realm this policy exists in.
    ResourceServerId string
    The ID of the resource server this policy is attached to.
    Type string
    The provider type of the policy, i.e. the id returned by the policy's PolicyProviderFactory.getId(). For a custom Java SPI this is whatever id your factory exposes; for a JavaScript policy deployed as a script it is script- followed by the fileName declared in META-INF/keycloak-scripts.json, e.g. script-my-policy.js.
    decision_strategy string
    The decision strategy, can be one of UNANIMOUS, AFFIRMATIVE, or CONSENSUS.
    description string
    A description for the authorization policy.
    logic string
    The logic, can be one of POSITIVE or NEGATIVE. Defaults to POSITIVE.
    name string
    The name of the policy.
    realm_id string
    The realm this policy exists in.
    resource_server_id string
    The ID of the resource server this policy is attached to.
    type string
    The provider type of the policy, i.e. the id returned by the policy's PolicyProviderFactory.getId(). For a custom Java SPI this is whatever id your factory exposes; for a JavaScript policy deployed as a script it is script- followed by the fileName declared in META-INF/keycloak-scripts.json, e.g. script-my-policy.js.
    decisionStrategy String
    The decision strategy, can be one of UNANIMOUS, AFFIRMATIVE, or CONSENSUS.
    description String
    A description for the authorization policy.
    logic String
    The logic, can be one of POSITIVE or NEGATIVE. Defaults to POSITIVE.
    name String
    The name of the policy.
    realmId String
    The realm this policy exists in.
    resourceServerId String
    The ID of the resource server this policy is attached to.
    type String
    The provider type of the policy, i.e. the id returned by the policy's PolicyProviderFactory.getId(). For a custom Java SPI this is whatever id your factory exposes; for a JavaScript policy deployed as a script it is script- followed by the fileName declared in META-INF/keycloak-scripts.json, e.g. script-my-policy.js.
    decisionStrategy string
    The decision strategy, can be one of UNANIMOUS, AFFIRMATIVE, or CONSENSUS.
    description string
    A description for the authorization policy.
    logic string
    The logic, can be one of POSITIVE or NEGATIVE. Defaults to POSITIVE.
    name string
    The name of the policy.
    realmId string
    The realm this policy exists in.
    resourceServerId string
    The ID of the resource server this policy is attached to.
    type string
    The provider type of the policy, i.e. the id returned by the policy's PolicyProviderFactory.getId(). For a custom Java SPI this is whatever id your factory exposes; for a JavaScript policy deployed as a script it is script- followed by the fileName declared in META-INF/keycloak-scripts.json, e.g. script-my-policy.js.
    decision_strategy str
    The decision strategy, can be one of UNANIMOUS, AFFIRMATIVE, or CONSENSUS.
    description str
    A description for the authorization policy.
    logic str
    The logic, can be one of POSITIVE or NEGATIVE. Defaults to POSITIVE.
    name str
    The name of the policy.
    realm_id str
    The realm this policy exists in.
    resource_server_id str
    The ID of the resource server this policy is attached to.
    type str
    The provider type of the policy, i.e. the id returned by the policy's PolicyProviderFactory.getId(). For a custom Java SPI this is whatever id your factory exposes; for a JavaScript policy deployed as a script it is script- followed by the fileName declared in META-INF/keycloak-scripts.json, e.g. script-my-policy.js.
    decisionStrategy String
    The decision strategy, can be one of UNANIMOUS, AFFIRMATIVE, or CONSENSUS.
    description String
    A description for the authorization policy.
    logic String
    The logic, can be one of POSITIVE or NEGATIVE. Defaults to POSITIVE.
    name String
    The name of the policy.
    realmId String
    The realm this policy exists in.
    resourceServerId String
    The ID of the resource server this policy is attached to.
    type String
    The provider type of the policy, i.e. the id returned by the policy's PolicyProviderFactory.getId(). For a custom Java SPI this is whatever id your factory exposes; for a JavaScript policy deployed as a script it is script- followed by the fileName declared in META-INF/keycloak-scripts.json, e.g. script-my-policy.js.

    Import

    This resource can be imported using the format: {{realmId}}/{{resourceServerId}}/{{policyId}}.

    Example:

    $ pulumi import keycloak:index/genericClientAuthorizationPolicy:GenericClientAuthorizationPolicy deployed_js my-realm/3bd4a686-1062-4b59-97b8-e4e3f10b99da/63b3cde8-987d-4cd9-9306-1955579281d9

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Keycloak pulumi/pulumi-keycloak
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the keycloak Terraform Provider.
    keycloak logo keycloak logo
    Viewing docs for Keycloak v6.13.0
    published on Saturday, Aug 1, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-keycloak

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial