Unfortunatelly, authorisation flow is not continued after Identity Provider login ( Identity Provider Redirector or Identity Provider login via Username Password Form).
I have create a github issue and a related PR for this. Unfortunatelly, I have no response from Keycloak team for such a bloging bug.
That is unfortunate. Then limiting access to a client with groups/roles this way is out of the question. Because when logging in through the Password form, it will check if the user has the role required to log in to the client, but when you already have a cookie then it will not check for it. I guess I will need to find another way to to do role/group based limiting. I have found this as an alternative: Janik Vonrotz - Role based access control for multiple Keycloak clients
I agree that this is not ideal, and I would love that the PR from cgeorgilakis got merged.
Meanwhile, I am using a similar workarounf as posted by TafkaMax (From Janik)
I use a custom browser flow, using this keycloak-restrict-client-auth extension
This won’t work on first time login, as the cookie is not set, and password form either.
To workaround this, I have added a Post login flow in identity providers configuration.
This setup seems to work well, and based on policy or roles, I can allow|disallow access to different clients.
The good thing about keycloak-restrict-client-auth extension, is that clients that are not configured to use this extension, are not blocked by the auth flow.
