[keycloak-dev] limiting users to access specific clients only

I am building keycloak prototype apps that demonstrate authentication against deployed keycloak server. I have 2 js client apps under the same web-server with 2 different keycloak client JSON. I have: - Created realm -> poc-realm - Created clients for poc apps to authenticate against -> app1 and app2 - Created roles in app1 -> app1-user-role app2 -> app2-user-role - Created users -> app1-user and app2-user - Assigned roles -> app1-user-role to app1-user, app2-user-role to app2-user When I try to get redirected keycloak login for app1, I am able to login with app1-user and app2-user, and similarly I am able to login into app2 with app1-user and app2-user. Am I missing something? How do I ensure that app1-user isn't able to log into app2, and app2-user into app1? Although note that I have the same url patterns for *Valid Redirect URIs *of both clients. My JSON keycloak clients are correct: { "realm": "poc-realm", "realm-public-key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAryTAZE2+d/7uKduayhQlInhnD43jdPyBttVbERLXO7wN9juXIuO5SR5P75aIcy1Fpf5VTrL2Neb4iLeEGgTUHM7b0ycjNgK40CXcwhneSn0EIogDLqXfJ87efwH2UYG//3cWZsB9PjX440Yq4uh/pBs5aTw7hHhvlaF/LRTBibhpcy7N/cKPp2PRkhQbWX79EfIsFLg8IKDryazYkdsVoaVI20aeOyb9mfXSU+h7ZUZIKhY4hhtSK004ToD73HQvJ5U61Zv7UAEtKHOD928SO0/VijFkGCh7fHtOA4kNJhV6D7RehThz/llDE3rfs4wkO24L0j/hAss30OSQNnAD1QIDAQAB", "auth-server-url": "[server URL]/auth", "ssl-required": "external", "resource": "app1", "credentials": { "secret": "e119ccf7-5c5a-4681-b4fa-fcca1b3de3b3" }, "use-resource-role-mappings": true } and { "realm": "poc-realm", "realm-public-key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAryTAZE2+d/7uKduayhQlInhnD43jdPyBttVbERLXO7wN9juXIuO5SR5P75aIcy1Fpf5VTrL2Neb4iLeEGgTUHM7b0ycjNgK40CXcwhneSn0EIogDLqXfJ87efwH2UYG//3cWZsB9PjX440Yq4uh/pBs5aTw7hHhvlaF/LRTBibhpcy7N/cKPp2PRkhQbWX79EfIsFLg8IKDryazYkdsVoaVI20aeOyb9mfXSU+h7ZUZIKhY4hhtSK004ToD73HQvJ5U61Zv7UAEtKHOD928SO0/VijFkGCh7fHtOA4kNJhV6D7RehThz/llDE3rfs4wkO24L0j/hAss30OSQNnAD1QIDAQAB", "auth-server-url": "[server URL]/auth", "ssl-required": "external", "resource": "app2", "credentials": { "secret": "e119ccf7-5c5a-4681-b4fa-fcca1b3de3b3" }, "use-resource-role-mappings": true } Thanks for help.