How to add the notion of "accounts" to Keycloak?

user_280244 0
Viewed 123

How do I best configure Keycloak so that a user needs to have an account for a client to be able to login into that client?

I have to replace a proprietory SSO-Impl. It deals with users, roles and clients much like Keycloak. However, it also knows about accounts. A user is only allowed to login to a client if he has an account for that client.

In Keycloak, if a user simply exists in a realm he may login to a client of that realm. Nothing else is needed. So no "account" is needed. In the old application, he needs an account as well. What functionality in Keycloak is best suited to overcome this difference?

I have one idea:

Create a client-role in each client namend "HasAccount" and assign it to users. Then, restrict access if that role is missing. This is discussed here: "Restrict client access in a single realm with keycloak" It has at least two drawbacks:

  • It mixes authentication and authorization in the legacy app. I can understand that. But creating a role was already a workaround. That is why I described my initial problem here.
  • I have clients in 3+ languages/technologies. Adding functionality there seems like more work than in Keycloak.

Last remark:

Before you ask "This is not single sign on" anymore. It is only for administrative purposes. The admin can allow users to login into a client or not by creating an account or not. The user does not have to login a second time. If he is logged in in App A and has an account for App B, accessing App B works without logging in there.

keycloak oauth-2.0 openid-connect single-sign-on openid
1 Answers

A user is only allowed to login to a client if he has an account for that client. is really not a task for Identity Provider (IdP). It provides only identity and not authorization.

Of course you can ignore that and implement authorization as well. See: User attribute based web service access control by Keycloak

From the design perspective I would add auth reverse proxy in front of legacy app (but it isn't a best solution for SPA apps). Auth proxy will provide authentication via OIDC protocol and also authorization. Legacy apps may keep own OIDC authentication - it will be seamless auth from the user perspective, because SSO will be used.

Account entity - you can use group entity in the Keycloak instead of original account.

user_33486040
Related