Hi, I want to restrict login to a service based on whether the user has a role or not. I followed this SO answer: security - Keycloak: Role based client log-in access restriction for users - Stack Overflow and it works as expected for the form login. However, when I try to add exactly the same con…

I simplified the form a little bit, basically following any of the 3 alternative authentication steps up with the role check. However I still get the same behavior: Only the user/password authentication actually fails if the role is not present. If I use an IdP to log in, the role check is entirely …

Small correction: it does work for username/password based auth and cookie auth. It does NOT work for IdP logins.

Of course not, as the authentication via IdP is not done via the browser flow. Keycloak sends the users browser to the IdP, where the users authenticates itself. Afterwards, the user is being redirected back to Keycloak. In your IdP configuration in Keycloak, you can set flows which should happen, a…

@dasniko Thank you very much for your response. That’s actually a nice coincident. I watched one of your videos earlier which helped me understand the conditional executions :slight_smile: Ok, so if I understand you correctly then the IdP redirect execution is always the end of the flow. I thought…

Is there really no built-in way to deny access to certain clients based on roles?

If there is really no way to do the (recommended way of) authorization in/by the client, maybe this would help you: [image] Restrict user authentication for some group for SAML client Getting advice I have already configured and tested authorization via SAML with slack. I…

Thank you very much for those links @mbonn . They summarize pretty well the issues we are facing (application we have no control over) but unfortunately I think both of those end up with the same issue than I have currently: Neither solution covers brokered IdP logins. I don’t understand why this is…

The fact that the browser flow always ends after a brokered login caused days of brain-twist in my case… As Niko wrote above, you can handle brokered IdP logins by defining a flow with your authorizers and then add this flow at the end of your browser flow AND use this flow a post idp flow (can be c…

@mbonn thank you for the response. I had a very similar idea actually but haven’t tried it yet. I am a bit concerned about how secure it is. Are these 3 options (username/password, idp broker, cookie) the only ways to log into your Keycloak account or are there others? What about direct access gran…

Kerberos my be a 4th option. If you group the default authenticators (all of them marked “optional”) cookie, IDP-redirect, kerberos … to a “required” subflow and attach your authorizator on layer obove (also marked as “required”), the login should be secure. Direct access grants should be disabled …

Browser flow - conditional access denied for IdP login

Configuring the server

mbonn March 11, 2022, 8:16am 7

If there is really no way to do the (recommended way of) authorization in/by the client, maybe this would help you:

But you should not enable the “upload_scripts” feature, (“scripts” feature (without “upload_”) is needed and sufficient) and then deploy your authenticator as jar file:
https://www.keycloak.org/docs/latest/server_development/index.html#_script_providers

Topic		Replies	Views
Creating an authentication flow with role limits Getting advice	8	5905	April 4, 2023
Limiting SSO for certain users Getting advice	23	4883	January 8, 2023
IdP post-login flow per client Securing applications identity-brokering , oidc	4	3175	February 17, 2023
Restricting login to some clients based on client roles Getting advice authentication , client-configuration , oidc	3	1680	April 9, 2024
Authorization set, yet everybody is authorized Configuring the server	1	473	October 17, 2023

Browser flow - conditional access denied for IdP login

Related topics