You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Issue with Keycloak Browser Authentication Flow via SAML client
#38892
User visits Wazuh install and is redirected to Keycloak for authentication via SAML.
Upon successful authentication with Keycloak, the user is then sent back to the wazuh application.
Basically I am trying to deny access to the application if the user does not have a specific realm role:
I believe my issue is in Keycloak somewhere but I'm not sure where. The user is a regular user with no roles or groups associated with it.
I have a saml client that works fine for authentication to Wazuh but I'd like to deny access at keycloak login if the realm user does not have the necessary realm role.
I've duplicated the built in browser flow in my keycloak realm with the following:
The Saml client has the correct authentication flow override selected but it seems its not using it or ignoring the check I set:
I've tested this with previous users I had before (removed the role) and newly created users with no roles at all.
I removed cookies and other IDP related information to just test the role condition. Upon entering the password it seems like Keycloak is ignoring the check for the role and forwarding me to the wazuh application.
If anybody can shed some light on why I'm running into this issue will be greatly appreciated. Thank you
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
SETUP:
I believe my issue is in Keycloak somewhere but I'm not sure where. The user is a regular user with no roles or groups associated with it.
I have a saml client that works fine for authentication to Wazuh but I'd like to deny access at keycloak login if the realm user does not have the necessary realm role.
I've duplicated the built in browser flow in my keycloak realm with the following:
The Saml client has the correct authentication flow override selected but it seems its not using it or ignoring the check I set:
I've tested this with previous users I had before (removed the role) and newly created users with no roles at all.
I removed cookies and other IDP related information to just test the role condition. Upon entering the password it seems like Keycloak is ignoring the check for the role and forwarding me to the wazuh application.
If anybody can shed some light on why I'm running into this issue will be greatly appreciated. Thank you
All reactions