Hi,

Take a look at this:
https://www.keycloak.org/docs/latest/securing_apps/

What you essentially need is SAML 2.0 attributes. This should be supported out of the box. I will look into it, but feel free to setup a testing env for FreeIPA or Keycloak alone. If you combine both you also learn how to do sysadmin duties of RHEL's IDM solution, so that might come handy for you in the future. It isn't as daunting as it looks.

This has some nice examples that seem applicable:
https://ordina-jworks.github.io/security/2019/08/22/Securing-Web-Applications-With-Keycloak.html

TL;DR:

You need to be able to authenticate and retrieve some user attributes in a token.
This probably needs some internal parsing in your application (you can retrieve the token data from the Keycloak server, the token is pinned in the request headers).
Cache/session store the attributes you use. You may also want to sanitize the groups to alphanumeric strings just for peace of mind.

Securing Applications and Services Guide

Securing Web Applications With Keycloak Using OAuth 2.0 Authorization Code Flow and PKCE - Jeroen Meys

Ordina JWorks Tech Blog

[FEATURE_REQUEST] Group-dependent content (dynamic) #342

Company

Community

Support

Connect