Restrict login to specific group for one client

[mbonn]

for further reading, there have been some discussions on this in the past:

Limiting SSO for certain users

Hi all. Can you advise if there is any mechanism in the Keycloak that will limit SSO access to certain users or groups of users? For example, I have client1 and client2, Client1 should be accessible via SSO by all users, client2 should be accessible only by users with admin role.

Restrict user authentication for some group for SAML client

I have already configured and tested authorization via SAML with slack. It works. Now I would like to understand how to restrict realm users to login with different clients in this realm. Users are exported from LDAP (free ipa) with their groups. It would be great to restrict access based on the LDAP group, but it cannot be done easily. I tried to solve it like this: delete all mappers in client settings create a role (for example, with the name Slack access) create a client scope with the …