Decline the authentication for a specific client when a user isn’t a member of a group/role

[catshout]

I want to decline the authentication for a specific client when a user isn’t a member of a specific group or hasn’t a assigned role.

I checked this one

Can't get Keycloak to deny access if user not in group/role policy

Hi, I am a first time user of keycloak (after checking out a lot of different SSO solutions) so please bear with me. I have read a lot of articles and followed some tutorials to get things set up properly. I have things working now (Nextcloud authenticating through the nextcloud-social-login plugin with Keycloak), with user roles being properly assigned in Nextcloud. But I can’t seem to get the last bit working. I want to restrict access to Nextcloud to users in my realm who belong to a certain…

For my understanding I can define either a group or role policy and assign this to a permission (e.g. to the default permission).

I’d expect that the authentication returns a HTTP 401 if the user/password is valid but the permission isn’t given.

Tried this out but it doesn’t work as I thought. Am I wrong with my expectation? And if it should work as described, do I have to take care of anything else?

Best
Gerald