rules.json

[
    {
        "id": "allow-anonymous-with-header-mutator",
        "upstream": {
            "url": "https://httpbin.org/anything/header"
        },
        "match": {
            "url": "http://127.0.0.1:4455/anything/header",
            "methods": [ "GET" ]
        },
        "authenticators": [{
            "handler": "anonymous"
        }],
        "authorizer": {
            "handler": "allow"
        },
        "mutators": [{
            "handler": "header",
            "config": {
                "headers": {
                    "X-User": "{{ print .Subject }}"
                }
            }
        }]
    },
    {
        "id": "deny-anonymous",
        "upstream": {
            "url": "https://httpbin.org/anything/deny"
        },
        "match": {
            "url": "http://127.0.0.1:4455/anything/deny",
            "methods": [ "GET" ]
        },
        "authenticators": [{
            "handler": "anonymous"
        }],
        "authorizer": {
            "handler": "deny"
        },
        "mutators": [{
            "handler": "noop"
        }],
        "errors": [
            {
                "handler": "json",
                "config": {
                    "when": [{
                        "request": {
                            "header": {
                                "accept": ["application/json"]
                            }
                        }
                    }]
                }
            },
            {
                "handler": "redirect",
                "config": {
                    "when": [{
                        "request": {
                            "header": {
                                "accept": ["text/*"]
                            }
                        }
                    }]
                }
            }
        ]
    },
    {
        "id": "allow-anonymous-with-id-token-mutator",
        "upstream": {
            "url": "https://httpbin.org/anything/id_token"
        },
        "match": {
            "url": "http://127.0.0.1:4455/anything/id_token",
            "methods": [ "GET" ]
        },
        "authenticators": [{
            "handler": "anonymous"
        }],
        "authorizer": {
            "handler": "allow"
        },
        "mutators": [{
            "handler": "id_token"
        }]
    },

    {
        "id": "allow-with-token-and-keto",
        "upstream": {
            "url": "https://httpbin.org/anything/token-and-keto"
        },
        "match": {
            "url": "http://127.0.0.1:4455/anything/token-and-keto",
            "methods": [ "GET" ]
        },
        "authenticators": [{
            "handler": "oauth2_introspection",
            "config": {
                "scope_strategy": "exact",
                "required_scope": ["openid", "offline"],
                "cache": {
                    "enabled": false
                }
            }
        }],
        "authorizer": {
            "handler": "remote_json",
            "config": {
                "remote": "http://keto:4466/check",
                "payload": "{\"namespace\": \"default-namespace\", \"subject\": \"{{ print .Subject }}\", \"object\": \"token:and:keto\", \"relation\": \"get\"}"
            }
        },
        "mutators": [{
            "handler": "noop"
        }]
    }
]