Authorization Options

Securing applications
1

I’m new to Keycloak and put together a proof of concept using NextJS15 and AuthJS 5 for authentication. The setup includes:

  • two application websites
  • a dedicated client per application
  • multiple organizations that have access to one or both clients/apps

Authentication is working and I’m getting the access token with the claims that I’m expecting. I’m now adding authorization and researching options prior to implementation. Some questions that I have are:

  • I’m aware of krasamo/keycloak-typescript, react-keycloak/keycloak-ts, and keycloak-js. Are there others I should consider and what are the pros/cons?
  • There was a comment in the forums stating that UMA is not getting adoption. Does that still hold true, and if so, what other options should I consider?

Thank you

2

Easy peasy! Here’s a general overview (double-check with your authz requirements):

  1. Protection with OAuth 2.0 → Authorization rules based on scopes or identity claims.
  2. Define your authorization model → RBAC, ABAC, ReBAC, Policy-Based, etc.
  3. Policy Decision Point (PDP) → Internal or external.
  4. Policy Enforcement Point (PEP) → Internal or external → External: Proxy / API Gateway