KeyConf26: Enforcing Access Restrictions on the Keycloak Side #53986

ahus1 · 2026-10-14T19:00:15Z

ahus1
Oct 14, 2026
Collaborator

This was discussed as part of

KeyConf26: Wicked Keycloak Challenges – Session Results #53984

The group wants Keycloak to decide, based on configuration, whether an account may access a client at all.
Group representative: @thomasdarimont

Context

Keycloak already makes access decisions in several places, for example whether credentials are valid. Based on configuration, it could make further decisions, such as whether an account may log in to a specific client at all.

Problems

There is no standard way to make access decisions in Keycloak based on roles, groups or similar attributes. Each application has to enforce them itself. Typical requirements from the flipchart: a required role, group or attribute for a single client or for a set of clients.

Open questions

None recorded.

Sources and related GitHub issues

Thomas Darimont referred to an existing solution (link not recorded).
Ability to continue with "browser" authentication flow after Identity provider login #10250: role checks in the browser flow are skipped for users logging in via an identity provider. The thread proposes a "post browser authentication flow", overridable per client, which matches approach 1 below; kept open by the maintainers for reference.
keycloak-restrict-client-auth: community authenticator that restricts client access by client role or policy.

Solution approaches

Post-authentication flow: a new construct that runs after successful authentication.
Client access policy: model access to a client as a policy.
Combination: the post-authentication flow evaluates the client access policy. The group expects this combination to solve the problem.

Suggested improvements

Delimit the proposal from existing mechanisms: conditional authenticators, the client-scope condition added in Keycloak 26.1, client policies and Authorization Services.
Specify when the check runs. Ability to continue with "browser" authentication flow after Identity provider login #10250 shows that a check only in the browser flow is bypassed after an identity provider login; SSO sessions, token refresh and token exchange need the same answer.

ahus1 · 2026-10-14T19:13:51Z

ahus1
Oct 14, 2026
Collaborator Author

Here is a Feature description and a linked PoC (branch) for Client Access Policies:, prepared by @thomasdarimont https://gist.github.com/thomasdarimont/b3b8d1db3bd89c20d65eaa6c3e69256c

0 replies

Navigation Menu

Repository navigation

KeyConf26: Enforcing Access Restrictions on the Keycloak Side #53986

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

KeyConf26: Enforcing Access Restrictions on the Keycloak Side #53986

Uh oh!

ahus1 Oct 14, 2026 Collaborator

Context

Problems

Open questions

Sources and related GitHub issues

Solution approaches

Suggested improvements

Replies: 1 comment

Uh oh!

ahus1 Oct 14, 2026 Collaborator Author

ahus1
Oct 14, 2026
Collaborator

ahus1
Oct 14, 2026
Collaborator Author