www.icact.org

Member Login

TACT Journal Homepage

Call for Paper

Committee

Find My Paper

Author Homepage

Statistics & History

Welcome Message

Paper Procedure

FAQ

Paper Archives

Outstanding Papers

Program & Proceedings

Presentation Platform

Hotel & Travel Info

Photo Gallery

Scheduler Login

Seminar

Archives Login

Sponsors

Virual Oral Question and Answer


IEEE/ICACT20260076 Question.3 Questioner: abdelhadi.belfadel@irt-systemx.fr 2026-02-10 오후 3:32:11	IEEE/ICACT20260076 Answer.3 Answer by Auhor pes2202100486@pesu.pes.edu 2026-02-10 오후 3:32:11
How would this framework integrate with an Identity Provider like Keycloak? Would the authorization check happen during the token issuance (adding permissions to the JWT) or as a real-time call to your graph index at the API Gateway level?	While I am unaware of the exact specifics of how keycloak works, Google Zanzibar / SpiceDB is a alternate Authorization system to the Authorization features provided by Keycloak or any Identity Provider, and is intended to assume full responsibility of the authorization. Relationship based Access Control (ReBAC) systems in general usually function via a real time call instead of the authorization being embedded in a token to be statelessly checked. It might be possible to integrate some ReBAC systems with keycloak but that would be a non standard way of doing things, unless keycloak is only used for authentication and makes the real time call to spicedb. Such a use case is discussed in detail here: https://linen.authzed.com/t/28578814/how-does-spicedb-compare-to-keycloak-s There also seems to be an open github issue to add spicedb as a native authorization engine to keycloak: https://github.com/keycloak/keycloak/issues/45096

Select Voice