https://polaris.apache.org/tags/opa/Recent content in Opa on Apache PolarisHugoen-us<a href="https://www.apache.org/">Copyright © 2026 The Apache Software Foundation</a>.<br>Licensed under the <a href="https://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.https://polaris.apache.org/guides/keycloak-opa/Mon, 01 Jan 0001 00:00:00 +0000https://polaris.apache.org/guides/keycloak-opa/<h2 id="overview" id="overview">Overview<a class="heading-anchor" href="#overview" aria-label="Anchor">🔗</a> </h2> <p>This example uses Keycloak as an <strong>external</strong> identity provider for Polaris. Unlike the <a href="https://polaris.apache.org/guides/keycloak/">Keycloak IDP example</a>, it demonstrates <strong>fully external principals</strong>: a principal authenticated by Keycloak that never needs to exist in the Polaris metastore at all.</p> <p>Enabling fully external principals is done by setting the option <code>polaris.authentication.credential-mode=external</code>; it has two hard requirements, both enforced by Polaris at startup:</p> <ol> <li>The authentication type must not be the default (<code>internal</code>) one.</li> <li>The authorizer must not be the default (<code>internal</code>) one, since it authorizes requests using metastore-backed grants, which external principals don&rsquo;t have.</li> </ol> <p>This example satisfies both requirements: the default (and only) realm delegates authentication to Keycloak exclusively (<code>polaris.authentication.type=external</code>), and the whole deployment is authorized by <a href="https://www.openpolicyagent.org/">Open Policy Agent (OPA)</a> instead of Polaris&rsquo;s built-in authorizer.</p>