Repolode
Submit
sventorben

sventorben/keycloak-restrict-client-auth

A Keycloak extension that lets administrators restrict which users may log in to specific clients.

View on GitHub
Stars
443
Forks
35
Open issues
11
Last commit
9 days ago

What is it?

Out of the box, Keycloak does not let an administrator allow some users to authenticate with a given client while denying others. This extension adds that capability. A client is restricted by adding a client role named restricted-access or an authorization resource named Keycloak Client Resource. Only users who hold that role, or whom the resource's policies permit, can access the restricted client.

The restriction is enforced on every login path. A required action checks access at the end of each login regardless of which authentication flow was used, and a client policy executor checks access when tokens are issued, including on refresh and token exchange.

The project is written in Java and installed as a Keycloak provider. Installation and configuration are described on the project's documentation website.

Key features

  • 01Restricts a client to users who hold a specific client role.
  • 02Supports authorization resource policies as an alternative way to grant access.
  • 03Enforces the restriction at the end of every login, regardless of authentication flow.
  • 04Checks access during token issuance, including refresh and token exchange.

Use cases

  • Letting only certain employees sign in to an internal application managed by Keycloak.
  • Granting a partner or contractor access to one client without exposing others.
  • Applying per-client access rules in a Keycloak realm that serves many applications.

Things to know

  • The README badge states it targets Keycloak 26.8.0, so compatibility with other Keycloak versions is not stated.
  • The README recommends understanding the security implications before using the extension.

In collections

Login, SSO & identity servers

Topics

#keycloak#authorization#access-control#authentication#identity#java#access-management#client#flow#keycloak-authenticator

FAQ

What is keycloak-restrict-client-auth?
A Keycloak extension that lets administrators restrict which users may log in to specific clients. Out of the box, Keycloak does not let an administrator allow some users to authenticate with a given client while denying others. This extension adds that capability. A client is restricted by adding a client role named restricted-access or an authorization resource named Keycloak Client Resource. Only users who hold that role, or whom the resource's policies permit, can access the restricted client.
Is keycloak-restrict-client-auth free to use? What license does it have?
keycloak-restrict-client-auth is open source under the MIT license. Check the license terms before using it in commercial products.
Is keycloak-restrict-client-auth still maintained?
Actively maintained. The last commit to keycloak-restrict-client-auth was on Oct 29, 2026.
What can I use keycloak-restrict-client-auth for?
Letting only certain employees sign in to an internal application managed by Keycloak. Granting a partner or contractor access to one client without exposing others. Applying per-client access rules in a Keycloak realm that serves many applications.
Where can I get keycloak-restrict-client-auth?
The source code and installation instructions are on GitHub: https://github.com/sventorben/keycloak-restrict-client-auth

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects