[keycloak-user] Authorization at Keycloak level

[Edouard Kaiser]

Hi everyone,

We discovered Keycloak very recently (pretty impressive tool by the way,
congrats to the maintainers!), and we've been trying to configure a very
simple authorization at the Keycloak level without success.

Let me try to sum up what we are trying to achieve in our web-application.

For a Keycloak Client, we would like to only allow the users with a
particular Role to be able to login.

We thought that to achieve this, we needed to do this:
- Authorization enabled on the client
- Create a new Role-Based policy ton a particular role
- Create a Resource Permission to use the previously created Policy
- Use this Resource Permission in the Default Resource of the Client

We use openid-connect, and more specifically Google as the identity
provider.

By doing this, we thought that users without the role, trying to connect to
our application through Keycloak, would be redirected to our application
with an error of authentication, something like this in the redirection:

/login/oauthVerify?client_name=OidcClient&error=unauthorized&error_description=You%20are%20not%20allowed%20to%20access%20this%20application.&state=CrsA9f9bEzLWyjQfT5PN43MPxl_PfMgvXZDQrEzCHi8

Instead, it's like Keycloak does not check the Authorization configuration,
it redirects to our webapp with a proper authorization code. Then the
application is able to fetch the JWT successfully form the Keycloak token
endpoint.

Did we miss something? Are we trying to solve our issue in the wrong way ?

Thank you all for your help,
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160826/55df41c6/attachment-0001.html