title: How to configure RedHat APIMan Authorization Policy for unprotected endpoints?
body: <p>We have installed and configured RedHat APIMan for our working API and the plan is migration form current home-grown tiny gateway to APIMan. The problem is that we have some unprotected endpoints which do not need login (Not everyone role! No login required at all). We are using Keycloak OAuth plugin for roles, and Authorization Policy for API security. When Authorization policy is not added, I can allow unauthenticated requests via a boolean value in Keycloak OAuth policy, but after adding Authorization policy, there is no way to let unauthenticated requests pass!</p>
  <p><a href="https://i.stack.imgur.com/DNihx.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/DNihx.png" alt="Policy Configuration" /></a></p>
  <p><a href="https://i.stack.imgur.com/GpKuB.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/GpKuB.png" alt="Keyclock OAuth Policy COnfiguration" /></a></p>
  <p><a href="https://i.stack.imgur.com/aZu5X.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/aZu5X.png" alt="Allow other enpoints!" /></a></p>
  <p><a href="https://i.stack.imgur.com/tCa2b.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/tCa2b.png" alt="Result" /></a></p>