Authorization mechanism in Keycloak looking in DB for roles/permissions

I need to implement authorization mechanism in Keycloak which looks into my customer's DB for user's permission based in roles.

I can't manage such roles and permissions in Keycloak's admin console but I will have to write some SPI to implement my authorization logic. Something like implementing a User Storage Provider to look in DB for user/password autentication.

But I can't find how to implement it. I think that, after obtaining a valid token for the user in authentication process, the application should send that token along with the permission needed to perform an action so Keycloak (my own SPI implementation) would validate the token and search the DB to grant permission.

Maybe the flow of authorization is different to what I think (what I wrote before).

Any clue would be appreciated.

How should the application send the token + permission to Keycloak?

How to implement a SPI which responds to such petition and validates the token?

To answer your first question: Keycloak will handle the authorization flow for you, you don't need to worry about that part. All you need to do is to provide the User Storage SPI by implementing the methods of the UserStorageProvider interface.
Keycloak documentation: https://www.keycloak.org/docs/latest/server_development/index.html#_user-storage-spi

To also add the roles/permissions you need to implement the UserModel interface which has methods for handling roles/permissions. keycloak documentation: https://www.keycloak.org/docs/latest/server_development/index.html#model-interfaces

To combine these two, you would fetch the user record from the Oracle DB using the UserStorageProvider and fill in the UserModel fields (email, name, roles, etc..).

Ex pseudo code:

NOTE: look at keycloak documentation for a more detailed walkthrough: https://www.keycloak.org/docs/latest/server_development/index.html#simple-read-only-lookup-example

public class OracleDbUserStorageProvider implements UserStorageProvider, UserLookupProvider {

   private Map<String, UserModel> loadedUsers = new HashMap<>();

   private OracleDbRepository oracleDbRepository;

​   @Override
   ​public UserModel getUserByUsername(String username, RealmModel realm) {
       ​UserModel user = loadedUsers.get(username);
       ​if (user == null) {
           ​OracleUser oracleUser = oracleDbRepository.getUser(username);
           ​if (oracleUser != null) {
               ​user = convertToUserModel(oracleUser);
               ​loadedUsers.put(username, user);
           ​}
       ​}
       ​return user;
   ​}

   private UserModel convertToUserModel(OracleUser oracleUser) {
        // take oracleUser attributes and assign to a UserModel instance
        return userModel; // user model converted
   }

}

Hope this helps set you in the right direction.