Repository navigation
Replies: 1 comment
|
Can I ask why #38308 was closed? Is/Was it a bug that is now fixed or is it expected behaviour? |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Description
Hi,
I'm trying to restrict access to a client based on a user's role. The below example of the documentation works as long as the user signs in the said client.
https://www.keycloak.org/docs/26.1.4/server_admin/#explicitly-denyallow-access-in-conditional-flows
But if the user is already signed in, let's say through the account console, but really any client will do.
The user can access the role based restricted client via URL since he has the cookie and the authentication flow just lets them through. Which in my option defeats the whole purpose of the example in the Documentation.
I tried to make it work to adjust the flow but could not get a working configuration with only one conditional.
I have to repeat the role based conditional for each step. See example 2 below.
Can someone explain to me how I can make it work with just one conditional sub flow?
Or is it not possible?
Example 1: Default flow with added conditional, explained in the docs. Works only on sign-in!
Example 2: Custom Flow with 2 conditionals for sign-in and cookie auth
NOTE: This only works with the account console. Other clients would let them through on sign-in
I could just disable/remove the "role based access form" in example 2 and then have the user log-in and the cookie based flow would restrict the user. Is an alternative way which make it work like example 2 with just one conditional?
Thank you
Alex
All reactions