Repository navigation
Replies: 3 comments
|
I usually don't like enforcing policies on the IdP when it acts as a PEP (Policy Enforcement Point). I recommend delegating enforcement to the app, API, or API gateway based on the claims in the tokens. This approach provides more flexibility in delegating the decision. On the other hand, I believe there is no real link between the client and the organization when performing federation. Nevertheless, you can customize this behavior using a custom SPI. Keycloak provides references for cases where a specific role is required - see: ConditionalRoleAuthenticator. Therefore you can play with other identity attributes as well. |
|
Hi. |
Uh oh!
There was an error while loading. Please reload this page.
In a single-realm, multi-tenant architecture setup in Keycloak, each tenant is represented as an organization, and each organization has a corresponding client. The issue arises when users from one organization (Org1) can authenticate using the client of another organization (Client of Org2).
In modern IAM solutions, organizations can be linked to clients to enforce authentication restrictions—ensuring that users of a particular organization can log in only to their assigned client(s).
Currently, Keycloak does not provide an out-of-the-box way to enforce this restriction. I would like to know if there is a way to implement this within Keycloak, either through existing configurations or via custom extensions.
Expected Behavior:
Users should only be able to authenticate using clients associated with their organization. If they attempt to log in using a client linked to a different organization, authentication should be denied.
Environment:
Keycloak Version: 26.1.4
All reactions