# Keycloak authorization
**URL:** https://forum.keycloak.org/t/keycloak-authorization/9153
**Category:** Securing applications
**Created:** [May 20, 2021, 10:12am UTC](https://forum.keycloak.org/t/keycloak-authorization/9153 "2021-05-20T10:12:18Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@nestle2377](https://forum.keycloak.org/u/nestle2377)
#### Post date: [May 20, 2021, 10:12am UTC](https://forum.keycloak.org/t/keycloak-authorization/9153/1 "2021-05-20T10:12:18Z")
Hi to all, I’m trying to test the authorization process on keycloak on a openid connect client.
I’ve enable the authorization and associated a simple permission on a resource (/\*) with related policy that authorize only one user to that resource. well, if I test the policy with the evaluate function and I try two differente users the only one that is authorized is ok the other one no. so it seems that the authorization process works fine.
after this I test the client with an external provider like [https://oidcdebugger.com](https://oidcdebugger.com). at this point I retrieve the json token for both user after authentication when I expected to not enter with user not included in the policy… I miss something?
---
### Author:  [@Pimmetje](https://forum.keycloak.org/u/Pimmetje)
#### Post date: [May 22, 2021, 10:19pm UTC](https://forum.keycloak.org/t/keycloak-authorization/9153/2 "2021-05-22T22:19:35Z")
I am currently in the same (or similar) boat. If i deny a user access to client based on a group i expect keycloak the block the authentication. But instead keycloak leaves that to the application. (by providing this information to the SP application.
I can understand the design concept of it. And it may be right in that regard. But i don’t find it logical. And i even can’t find a good workaround. The only workaround i found requires a users to re-authenticate for login attempt.
Here some links
> **[Role based access control for multiple Keycloak clients](https://janikvonrotz.ch/2020/04/30/role-based-access-control-for-multiple-keycloak-clients)**
>
> Role based access control (RBAC) is a common feature in identity and access management (IAM) systems. Granting access to applications by assigning roles to a selection of users is the proper way to manage access permissions.
>
> In this guide I will...
>