我将如何隔离客户端访问、keycloak 配置

Question

How would I isolate client access, If I have more than one client. what I am trying to achieve is the issued access token should only be valid for the intended service. example. If I have two clients client1 and client2, the token issued to client1 should not be able to access resources from client2, at the moment my set up permits this both clients access type is set to confidential. and the JWT token does contain the client_id(which is "aud") field but this is not evaluated at the authentication stage.

Answer 1

There's multiple ways this can be achieved. The method I would use would be to define a role inside each client, which the user has to have to access that client. Then you would check before allowing access to that client that they have that client role.

To create a client role, inside the admin console, choose your "realm", then "Clients" from the left hand menu => select "client2" => select "Roles" => "Add Role", and name it what ever you want. Say "admin".

To grant that role to a user so they can access that client, go to "Users" => Select your user => Role Mappings => Under the client role section select your client => select your new role and assign it to the user.

You then need to limit the scope access from client 1 by going "Clients" => "Client 1" => "Scopes tab" => Uncheck "Full scopes allowed" => select "client 2" from "Client Roles" drop down, and ensure the role isn't applied to this client.

You can now test out wether this user will get access to this role from logging into "client 1" by going to "Clients" => "Client 1" => "Client Scopes" => "evaluate tab". If the client scopes are configured correctly, you shouldn't gain access to client 2 role.

The last piece of the puzzle is configuring your Client to check for this role. On your backend API (or other client side enforcement location), configure keycloak to protect against the newly created client role for that client. For example, if your API was written in Node, you would use the Keycloak Node adapter, set it up for "Client 2" app.get( '/special', keycloak.protect('admin'), specialHandler );

More information regarding protection using adapters can be found here: https://www.keycloak.org/docs/latest/securing_apps/#_nodejs_adapter