Keycloak - Limit users access per client/application

Question

I've just setup my first Keycloak server to offer SSO between two applications. These are not Java applications, and one is connected with SAML-2 and the other with OpenID Connect.

So in Keycloak I have Realm-1, and then Client-1(application1) and Client-2(application2) and user-1 and user-2.

Now I want user-1 to only be allowed access to Client-1, and user-2 to be allowed access to both Client-1 and Client-2. Should be simple enough.

I have tried to read up on Roles and Authorization, but I find the documentation(or maybe just the topic) very confusing. I have been playing around with it with no success. I was expecting an interface to just map a group to a Client, and restrict access to the Clients by adding/removing users from groups.

Answer 1

If you are using SAML:

1. Create a new role in Keycloak.
2. Assign this role to the group.
3. Create new authentication script in Keycloak. Configure which role is allowed upon login (e.g. user.hasRole(realm.getRole("yourRoleName")) ).
4. In client setting, under "Authentication Flow overrides" choose the created authentication(from step 3).

If you are using openid, look at the comment in this thread