I’m trying to set up Keycloak to work like our old SSO system. In the previous system, users needed specific accounts tied to each application before they could access it. Right now in Keycloak, any user in a realm can login to any client in that realm automatically.
I need to add an extra layer where users can only access clients they have been explicitly granted access to. This is for admin control - admins should be able to decide which users can use which applications.
I thought about creating a custom role like “AccessGranted” for each client and assigning it to users who should have access. Then I could check for this role before allowing login. But this approach has problems:
It feels like mixing up authentication with authorization
I would need to implement role checking across multiple client applications in different programming languages
What’s the best way in Keycloak to restrict user access to specific clients? I want to keep the SSO behavior where users don’t need to login multiple times, but add the ability to control which apps each user can access.
Is there a built-in Keycloak feature that handles this kind of per-client user authorization?
I’ve been through this exact mess when we had multiple internal tools needing different access levels. Roles work fine, but managing them manually becomes a total nightmare once you scale up.
Automating the whole access control flow saved our sanity. We ditched manual role assignments and complex mappers. Built automation that handles user provisioning and client access based on our business rules.
Someone requests app access? The automation checks their department, role, and approval status, then assigns the right Keycloak roles and permissions automatically. They leave a team? Access gets revoked instantly.
Best part: all the complexity stays in the automation layer instead of being scattered across different client apps. Your apps just check standard Keycloak token claims. The automation makes sure only the right users get the right claims.
We added automated reports too - admins can see who has access to what without digging through Keycloak’s admin console.
This scales way better than manual role management and keeps client apps simple. Let automation handle all the business logic about who gets what access.
just create groups in keycloak for each client and assign users to those groups. way simpler than messing with authorization services or custom roles. set up group mappers so only users in the right group get access tokens for that client. i’ve been using this approach for years and it scales fine without overcomplicating things.
Your custom roles approach is actually pretty solid. I built something similar for a client with 15+ apps and it worked great. Skip the “AccessGranted” roles though - just use Keycloak’s client roles with audience mappers. Give each client specific roles, assign users only what they need, and their tokens will only include audiences for accessible clients. Handle this at the token level, not in each app. Set up your clients to check the audience claim in JWT tokens. No client ID in the audience? Reject it. This keeps everything centralized in Keycloak instead of spread across your apps. For admin stuff, use Keycloak’s admin API to assign client roles based on your business rules. We built a simple interface that hits these APIs so admins don’t have to deal with Keycloak’s messy admin console. This isn’t mixing auth and authz - you’re using Keycloak’s authorization features properly. SSO still works fine since users authenticate once, but access gets controlled per client through token validation.
try using client scopes and mappers in keycloak. you can set up custom claims for each client, so users only get access to what they need. all the validation is done at token verification, no need to juggle roles - makes life way easier.
We hit this exact issue migrating from an old enterprise SSO. Here’s what worked for us: skip roles and use Keycloak’s authorization services instead. Go to each client in the admin console and set up authorization policies under the Authorization tab. This gives you way more control over who can access what without building custom roles. Configure your clients to hit Keycloak’s authorization endpoint during login. If someone doesn’t have permission for that client, Keycloak blocks them before issuing any tokens. Best part? This all happens at the Keycloak level, so your apps don’t need authorization logic. Users still get single sign-on, but now Keycloak handles client access behind the scenes. This cleanly separated our auth from authorization and gave admins the granular control they wanted through Keycloak’s policy management.