Repository navigation
How to setup RBAC for Identity Provider based Client authentication #40310
Replies: 4 comments
|
Yes, this... it seems so fundamental. There are even instructions we have tried, which unfortunately do not restrict access when the user does not have the role marked as "required". |
|
Sorry - that doesn't read right... |
|
This is so frustrating. I have the exact same problem. Enabling Google Oauth just bypasses the flow rules that are defined for the login form. You cannot define a post login flow for external providers on a per cleint basis and so it becomes impossible to restrict user access to clients in one realm. Only solution so far: multiple realms, which works but bings a lot over overhead and other problems -_- |
|
I don't want multiple Realms, which = multiple 'apps' on the external IdP and more cost, so for now any user in our local Db is 'authorized' for any client app. It's annoying that Keycloak says it does authorization, when all it will really do is send info to the backend app, where the app will then have to do the actual authorization. They should make this explicit up front so those of us with dumb legacy apps/sites know and don't spend days trying to figure it out! |
Uh oh!
There was an error while loading. Please reload this page.
How can I allow or restrict users from authenticating into a specific client based on their role when the authentication method used is an Identity Provider (e.g., Google)?
I was able to achieve this for username and password-based logins by customising the Browser Authentication Flow.
However, in my setup, the realm contains multiple clients that share the same user base. Therefore, I cannot modify the Broker Authentication Flow for the Google Identity Provider, as it is shared across all clients.
All reactions