Keycloak: Role based client log-in access restriction for users

Question

I am trying to achieve fairly simple usecase of role based client application (VueJS multi-page applications) control using the keycloak.

As shown in image, I have three different roles and three different clients in single realm.
The arrow in the image represents which role can access which client.

So my main objectives are,

• User with role Viewer should only be able to log-in to the Viewer Application. If the same user tries to access the Operator Application or Admin application then keycloak should simply deny this user from doing so.
• The same rules should follow for users with Admin and Operator role. Users of Admin role should be able to log-in to any of these application by keycloak.

To achieve this usecase I tried following ways,

• First by appropriate role mapping to users and role creation in the clients. In this case, I create realm level roles and then client level roles, then assigned appropriate roles to the users created in the user section.
• Enabling the Authorization. In the policies, I removed default policy that grant all users access to the client. And create a User policy and Client policy to restrict the access to client application
• Also tried with Group based authorization policy. In this case, I created a group with client role and then assigned user to these groups. And enabled them from the Authorization group policy.

But, unfortunately none of this works. Meaning my user with Viewer role can log-in to my admin application. Which is just strange.

Answer 1

You can do this without extensions.

• Copy the desired flow (e.g. the browser flow)
• Create a new sub flow (e.g. for the browser forms) and call it Access By Role and select generic as type.
• For the new sub flow ensure that CONDITIONAL is selected in the flow overview.
• For the new sub flow add execution Condition - User Role, make it REQUIRED and configure it:
  • alias: admin-role-missing
  • role: admin (or whatever your role is)
  • negate: true
• Add another execution: Deny Access and make it REQUIRED as well.

The final result should look similar to this:

This will deny access if the condition "admin-role-missing" is true.

You an also learn more from the docs: explicitly-deny-allow-access-in-conditional-flows

Also, don't forget to go to your client and select the flow in the authentication overrides.

Answer 2

I managed almost the same problem using KeyCloak extension SPI. After the deployment you will have additional configurable "execution" in authentication flows available, named "Validate User Role".

The auth flow then look's like :

This execution must be placed after the "Username Password Form" (or other form which authenticates user) or the authentication will fail.

The source code is here : https://github.com/ValentinChirikov/kc_user_role_validate_extension