anchor.diff:  curl -X POST http://127.0.0.1:8080/auth/realms/stottie/protocol/openid-connect/token  -H "Content-Type: application/x-www-form-urlencoded" -d 'username=rincewind' -d 'password=apiman' -d 'grant_type=password' -d 'client_id=apiman' | jq -r '.access_token'
   ```
   
  -Second, we'll take the token and attach it to our request to the service
  +Second, we'll take the token and attach it to our request to the API
   
   ```
   [msavy@mmbp tmp]$ curl -k -H "Authorization: Bearer eyJhbGciOiJSUzI1NiJ9.eyJqdGkiOiJiNDY1YW..." https://127.0.0.1:8443/apiman-gateway/Newcastle/EchoAPI/1.0
  
positive.code: ---
  layout: post
  title:  "Keycloak and dagger: Securing your services with OAuth2"
  date:   2016-01-10 15:25:28 +0100
  author: marc_savy
  categories: gateway security oauth2 keycloak authentication authorization 1.2.x
  
negative.code: 
  The more observant readers will note that we have already added two of the required elements when we imported the realm into Keycloak; namely, a user `rincewind` and a realm role `echomeister`.
  
  If we navigate back to the *EchoAPI* API in the apiman UI, we can create a *New Version*. We'll call it *_2.0_* and clone the previous configuration. Moving over to the *Policies* tab again, we *Add Policy* and select *Authorization Policy* from the drop-down.
  
  We're going to add two rules:
  
  