Hi I have local docker setup with runing Kratos, Oathkeeper and Keto. I'm trying to put Oathkeeper in front of Keto write API: My oathkeeper.yml authorizers config is :

authorizers:
  allow:
    enabled: true
  keto_engine_acp_ory:
    enabled: true
    config:
      base_url: "<http://host.docker.internal:4467>"
      required_action: "..."
      required_resource: "..."

My access rule is:

- id: "ory:keto-admin-api:protected"
  upstream:
    preserve_host: false
    strip_path: "/keto-admin"
    url: "<http://host.docker.internal:4467>"
  match:
    url: "<http://localhost:4455/keto-admin/><**>"
    methods:
      - GET
      - POST
      - PUT
      - DELETE
      - PATCH
  authenticators:
    -
      handler: cookie_session
  authorizer:
    handler: keto_engine_acp_ory
    enabled: true
    config:
      required_resource: "Role:members:{{ print print .Extra.identity.id }}"
  mutators:
    - handler: noop # id_token
  errors:
    - handler: redirect
      config:
        to: <http://localhost:3000>

My keto.namespaces.ts is:

import {Context, Namespace, SubjectSet} from "@ory/keto-namespace-types"

class User implements Namespace {
  related: {
    members: User[]
    admins: User[]
  }

  permits = {
    modify: (ctx: Context): boolean =>
      this.related.admins.includes(ctx.subject),
  }
}

class Role implements Namespace {
  related: {
    members: SubjectSet<User, "members">[]
  }
}

class AccessGroup implements Namespace {
  related: {
    members: SubjectSet<Role, "members">[]
  }

  permits = {
    view: (ctx: Context): boolean =>
      this.related.members.includes(ctx.subject),
  }
}

I want to check the user to be subject of the namespace "Role" with object "admin". Can somebody help me?

@green-oil-88994 note that keto_engine_acp_ory is being deprecated, see here: https://community.ory.sh/t/problems-with-configuration-of-keto-engine-acp-ory-authorizer/2079 You should use remote_json instead: https://www.ory.sh/docs/oathkeeper/pipeline/authz#remote_json and get the information needed to authorize the user from the cookie session info.

OK, thanks!