@Override
    protected void doApply(final ApiRequest request, final IPolicyContext context,
            final KeycloakOauthConfigBean config, final IPolicyChain<ApiRequest> chain) {

        if (keycloakDeployment == null || checkIfRealmChanged(config.getRealm())) {
            configureKeycloakDeployment(config);
        }

        final String rawToken = getRawAuthToken(request);
        final Holder<Boolean> successStatus = new Holder<>(true);

        if (rawToken == null) {
            if (config.getRequireOauth()) {
                doFailure(successStatus, chain, failureFactory.noAuthenticationProvided(context));
            } else {
                chain.doApply(request);
            }
        } else if (doTokenAuth(successStatus, request, context, config, chain, rawToken).getValue()) {
            // Transport security check
            if (config.getRequireTransportSecurity() && !request.isTransportSecure()) {
                // If we've detected a situation where we should blacklist a token
                if (config.getBlacklistUnsafeTokens()) {
                    blacklistToken(context, rawToken, (IAsyncResult<Void> result) -> {
                        if (result.isError()) {
                            LOGGER.error("An error occurred when blacklisting a token",
                                 result.getError());
                        }
                    });
                }

                doFailure(successStatus, chain, failureFactory.noTransportSecurity(context));
                return;
            }

            // If enabled we check against the blacklist
            if (config.getBlacklistUnsafeTokens()) {
                isBlacklistedToken(context, rawToken, (IAsyncResult<Boolean> result) -> {
                    if (result.isError()) {
                        throwError(successStatus, chain, result.getError());
                    } else if (result.getResult()) {
                        doFailure(successStatus, chain, failureFactory.blacklistedToken(context));
                    } else {
                        chain.doApply(request);
                    }
                });
            } else {
                if (successStatus.getValue()) {
                    chain.doApply(request);
                }
            }
        }
    }
@see io.apiman.gateway.engine.policies.AbstractMappedPolicy#doApply(io.apiman.gateway.engine.beans.ApiRequest,
     io.apiman.gateway.engine.policy.IPolicyContext, java.lang.Object,
     io.apiman.gateway.engine.policy.IPolicyChain)
plugins/keycloak-oauth-policy/src/main/java/io/apiman/plugins/keycloak_oauth_policy/KeycloakOauthPolicy.java