Keycloak: how to set and restrict scopes of resource server per user

I am developing a spring boot 3 and spring security 6 application. The application is rest api. I will use spring security, spring security resource sever for authorization. Endpoint will be annotated with @PreAuthorize("hasAuthority('SCOPE_scope-name')") to restrict access to it. I want to use OIDC, JWT.

I will use keycloak as the authorization server. Now, I want to restrict access to resources/api for specific user groups. Suppose I have user a,b,c and x,y. User a,b,c will have access to scopes read:test and write:test. But users x,y will only have access to scope read:test. Even if user x,y asks for the write:test scope, keycloak will not give the scope to these users.

Preferably I want to use user groups to easily manage the users. Preferably some roles will be created and assigned to user groups. Each role will have some set of scopes that the role will allow access to. I tried reading the documentation. It was confusing to me. There are scopes and roles in different places. I did not understand how can I achieve what I want to do.

According to spring security documentation, In the application.properties file I just have to set spring.security.oauth2.resourceserver.jwt.issuer-uri. I do not understand how keycloak/spring application will know which client/resource server is this application from just the issuer-uri settings.

In keycloak, how do I set, manage scopes for API endpoint for a resource server, and restrict those scopes per user?

Scopes Are Not Roles

You may see:

• roles as what a user is allowed to do
• scope as what a client is allowed to do on behalf of a user

Scope is defined the OAuth2 spec, but there is nothing about roles, groups, permissions, grants or whatever user access representation. Authorization servers vendors use private claims for that.

By default, Keycloak uses realm_access.roles and resource_access.{client-ID}.roles, but you may define your own mappers to use any claim you like.

Converting Keycloak Roles to Spring Authorities

As there is no standard for roles in OAuth2, Spring default authorities converter uses scope claim as source and prefixes each entry with SCOPE_.

This is rarely satisfying and you frequently need to provide with your own authorities converter.

Complete Working Samples

Refer to my tutorials. In addition to working samples, you'll find some of the OAuth2 / OpenID background you seem to be missing.

Scopes are fixed at design time and do not provide a full authorization solution. When you want dynamic authorization per user, you must use claims instead. Arrange users into roles however you would like. In Keycloak, at the time of token issuance, include values such as these in tokens:

{
  scope: orders,
  role: customer,
  access_level: read
}

More generally think of a scope representing a business area and being composed of claims. Look into Keycloak claims mappers for the vendor specific way to manage this.

USING CLAIMS

Your Spring resource server will then just receive such values in the authenticated principal, after validating the JWT access token. You can then use these values in the API's business authorization code.

Here is some example code of mine, to give you an idea of how claims can be injected then used for business authorization. Annotations may work to deny access in some cases. In others you will need to do things like filter collections to contain only authorized items.

• Authenticated principal

• Authorization logic