Repository navigation
Is fine-grained (per-scope) user consent on the roadmap? #50959
gillespelletiermcn
started this conversation in
Ideas
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Title: Is fine-grained (per-scope) user consent on the roadmap?
Hi Keycloak team,
Is there any plan on the roadmap to support fine-grained user consent, where users can individually accept or decline each optional client scope on the consent screen, instead of the current grant-all-or-deny behavior?
Prior art and demand signals:
Beyond GDPR and the US Cures Act already mentioned there, Québec's privacy law ("Law 25") now requires consent to be requested clearly and distinctly for each purpose, and to be freely given — declining an optional purpose must not block access to the service. All-or-nothing consent cannot meet these requirements, which affects every Québec public-sector deployment of Keycloak.
We have built this as a custom authenticator on 26.6.x (per-purpose checkboxes generated from tagged optional client scopes, non-blocking step,
scopenote rewriting so tokens reflect actual choices,UserConsentModelfor self-service revocation). It works, but this really belongs in core.If this is not currently planned: would the maintainers be open to a design proposal and a contribution in this area? Happy to invest the effort if there is a path to acceptance.
All reactions