Keycloak: Restrict user authorization on clients
This is a Keycloak extension to restrict user authorization on clients.
What is it good for?
As a Keycloak consultant, I often receive inquiries about restricting user authorization for specific clients. People commonly ask,
Can I allow certain users to authenticate with a client while denying access to others?
While the answer used to be "no" for out-of-the-box Keycloak, I have developed this extension to meet this need. I recommend taking the time to understand the potential security implications before using this extension.
How does it work?
You restrict a client by adding a client role named restricted-access or an authorization resource named Keycloak Client Resource to it. Users may only access a restricted client if they have the role or if the policies of the resource permit access.
The restriction belongs to the client, and access is checked on every path: a required action checks access at the end of every login, no matter which authentication flow has been used, and a client policy executor checks access whenever tokens are issued, including refresh and token exchange.
Documentation
Please refer to the documentation website for instructions on installation, configuration, features, and general usage.
