[keycloak-user] Restrict access to a client to a subset of Keycloak users

Hi everyone, I'm trying to figure out a fairly straight-forward problem set - - I have a number of users in a Keycloak database, federated from an LDAP provider with a READ_ONLY policy (ie; I can't "disable" the users) - I want to limit access to a client to only certain Keycloak users I thought this would be possible with a role that is shared by the client and the user. However, it looks like Keycloak lets the application itself determine access via a role: http://lists.jboss.org/ pipermail/keycloak-user/2014-November/001205.html But what if I can't update the application's behaviour? Eg; if I want to integrate Keycloak with OpenShift, and OpenShift doesn't consume any information from the OIDC provider? In this particular example, I don't want to limit the users in the Keycloak database - I want to sync all users from LDAP, but limit application access to only a subset. Any assistance is greatly appreciated. Shane