# User authentication by group

**URL:** <https://forum.keycloak.org/t/user-authentication-by-group/9042>\
**Category:** Securing applications\
**Tags:** authentication, oidc\
**Created:** [May 12, 2021, 3:12pm UTC](https://forum.keycloak.org/t/user-authentication-by-group/9042 "2021-05-12T15:12:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![nikita-s](https://avatars.discourse-cdn.com/v4/letter/n/2bfe46/32.png) [@nikita-s](https://forum.keycloak.org/u/nikita-s)\
**Post date:** [May 12, 2021, 3:12pm UTC](https://forum.keycloak.org/t/user-authentication-by-group/9042/1 "2021-05-12T15:12:30Z")

</div>

Hello,

How can you prohibit authentication for users of a specific group?

Tried using Client Scope-Based Policy ([Authorization Services Guide](https://www.keycloak.org/docs/latest/authorization_services/#_policy_group)), but nothing worked, the user is still authenticated.

Policy:

 ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/8/83de7f22468178a5645cf4f6366f921231159413.png)

**Expected Behavior:**  
If the user is a member of the group “group1”, then when entering the login and password, Keycloak prohibits the entry into the system.

Thank you!

---

<div class="post-metadata">

**Author:** ![melancholia](https://avatars.discourse-cdn.com/v4/letter/m/dbc845/32.png) [@melancholia](https://forum.keycloak.org/u/melancholia)\
**Post date:** [May 12, 2021, 5:08pm UTC](https://forum.keycloak.org/t/user-authentication-by-group/9042/2 "2021-05-12T17:08:43Z")

</div>

In the process of researching restriction of impersonation to client – came across the following, which may be of interest to you: [single sign on - How can I restrict client access to only one group of users in keycloak? - Stack Overflow](https://stackoverflow.com/questions/54305880/how-can-i-restrict-client-access-to-only-one-group-of-users-in-keycloak)