I see. I'm going to check what is happening. Can't understand why it works after re-creating the policies. So, you were using which version before migrating to 2.5.0 ? Did you also try a build from upstream ? On Tue, Jan 24, 2017 at 11:04 AM, Ushanas Shastri <ushanas(a)gmail.com&gt; wrote: > Hello Pedro, > > Policies created by us stop working. For example, without any change > the Evaluation API shows Deny, and we can't investigate why, as the > policy results in Resource not found. > > Interestingly, while the Evaluation API in the administration console > says denied, the protected application gets a permit when using the > Authorization API. > > We then recreate the policies, permissions and all is good again. > > Regards, Ushanas. > > > On 24-Jan-2017 5:05 PM, "Pedro Igor Silva" <psilva(a)redhat.com&gt; wrote: > > HI Ushanas, recently we made a specific change to update policies types > from "drools" to "rules". But that was in 2.5.1, so I think it is not case. > > Can you elaborate more what are those random instances of policies ? Are > they being created somehow but not by you ? > > Regarding the resource not found, I think I have fixed this with this PR > https://github.com/keycloak/keycloak/pull/3766/. It should be available > on 2.5.1. > > Thanks. > > On Tue, Jan 24, 2017 at 12:51 AM, Ushanas Shastri <ushanas(a)gmail.com&gt; > wrote: > >> Hello, >> >> I've created scope based permissions tied to role based policies. Any >> new >> permission or policy we create, all looks right, but we find random >> instances of policies that deny authorization, and when we want to >> investigate, we can't even see the details of the policy. It shows up >> in >> the list, but clicking on it takes us to a resource nor found page. >> Any ideas on what may be happening here? >> >> Regards, Ushanas. >> _______________________________________________ >> keycloak-user mailing list >> keycloak-user(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/keycloak-user >> > > >