Keycloak ABAC Configuration: Step-by-Step Guide

Want to secure your resources with precise access control? Keycloak‘s Attribute-Based Access Control (ABAC) lets you manage access dynamically using user attributes, resource properties, and environmental factors. Unlike traditional Role-Based Access Control (RBAC), ABAC evaluates multiple conditions like location, time, and user clearance for more granular permissions.

Key Highlights:

• Why ABAC? It goes beyond roles, considering attributes like department, file sensitivity, and access time.
• What You Need: Keycloak (v18+), admin console access, and a configured realm.
• Steps to Implement:
  1. Configure resources with attributes like department or clearance level.
  2. Define scopes for actions (e.g., view, create).
  3. Create policies using JavaScript for dynamic decisions.
  4. Link policies to permissions and test thoroughly.

Quick Comparison: RBAC vs. ABAC

Feature	RBAC	ABAC
User Context	Roles only	Department, clearance, location
Resource Properties	Basic permissions	Sensitivity, project association
Environmental Factors	Not considered	Time of day, access location
Action Context	Limited by roles	Operation type, resource state

Pro Tip: For enterprise environments, tools like Skycloak simplify ABAC setup with pre-built templates and advanced policy management.

Ready to dive in? Follow this guide to configure ABAC in Keycloak and secure your resources with dynamic, attribute-based policies.

Resource and Scope Setup

Resource Configuration

In Keycloak, resources represent protected assets like APIs, web pages, or data that require access control via ABAC policies. Here’s how to configure a resource with attributes in the Keycloak Admin Console:

1. Access the Resource Interface
   Go to your realm’s Authorization settings, open the "Resources" tab, and click "Create" to start configuring a new resource.
2. Set Resource Properties
   Use reverse-DNS notation to define essential properties for the resource:

   Property	Example Value	Purpose
   Name	com.example.resources.financial_records	Unique identifier
   URI	/api/financial/*	Resource path pattern
   Type	urn:financial-document	Resource classification
   Owner	${user.id}	Resource ownership

3. Add Attributes
   Specify attributes that Keycloak will evaluate during access decisions. For example:

   {
     "department": "finance",
     "classification": "confidential",
     "clearanceLevel": "5"
   }
   

Once the resource is configured, the next step is to define scopes to control the permitted actions.

Scope Definition

Scopes are typically aligned with standard HTTP methods to define what actions are allowed. Here’s a quick reference:

Scope Name	HTTP Method	Usage
view	GET	Read-only access
create	POST	Resource creation
update	PUT/PATCH	Modification rights
delete	DELETE	Resource removal

To create and associate scopes with resources:

1. Go to Authorization > Scopes in the Keycloak Admin Console.
2. Add new scopes using a format like urn:resource:action.
3. Link these scopes to resources using the "Authorization Scopes" field.

Keycloak allows wildcards in resource URIs, so patterns like /account/* automatically protect all sub-resources under that path.

Tips for Enterprise Environments

For large-scale implementations, consider these practices:

• Use consistent and descriptive naming conventions (e.g., resource-type:action).
• Set up scope hierarchies to simplify management.
• Define resource attributes for more granular access control.

Keycloak versions 21 and later include hierarchical attribute inheritance for resource paths. This means child resources automatically inherit attributes from their parent resources, making it easier to manage complex hierarchies while maintaining consistent access rules.

Authorization simplified | Keycloak edition

ABAC Policy Creation

ABAC policies rely on user, resource, and contextual attributes to make access decisions. In Keycloak, these policies use a JavaScript-based policy engine for detailed attribute evaluation.

Writing ABAC Policies

1. Create an Access Policy
   Go to the Keycloak Admin Console and navigate to Authorization > Policies. Choose "JavaScript" as the policy type to define attribute-based rules.
2. Define Policy Logic
   Write policies that evaluate multiple attributes. Here’s an example:

   var context = $evaluation.getContext();
   var attributes = context.getAttributes();
   var identity = context.getIdentity();
   
   // Validate department and clearance level
   if (identity.getAttributes().department[0] === 'finance' &&
       parseInt(identity.getAttributes().clearanceLevel[0]) >= 
       parseInt(attributes.clearanceLevel[0])) {
       $evaluation.grant();
   } else {
       $evaluation.deny();
   }
   

3. Test the Policy
   Use the Keycloak Policy Evaluation Tool to test the behavior and ensure the policy works as intended.

Once individual policies are set, combine them to handle more complex access scenarios.

Policy Combination Rules

Sometimes, multiple policies need to work together for complex access decisions. Keycloak provides different strategies for combining policies:

Strategy	Description	Example Use Case
Unanimous	All policies must grant access	High-security resources requiring multiple checks
Affirmative	At least one policy must grant access	Flexible conditions with multiple valid paths
Consensus	Majority of policies must grant access	Balanced approach for multi-policy evaluation

Tips for Enterprise Implementations

1. Group Policies Logically
   Organize policies around business functions for clarity. For example:

   // Check department alignment
   if (identity.getAttributes().department[0] === attributes.requiredDepartment[0]) {
       $evaluation.grant();
   }
   
   // Validate access within business hours
   var currentHour = new Date().getHours();
   if (currentHour >= 9 && currentHour <= 17) {
       $evaluation.grant();
   }
   

2. Use Hierarchical Evaluation
   Design cascading policies that start with broad checks and move to more specific conditions:

   // General access policy
   if (!identity.hasRole('employee')) {
       $evaluation.deny();
       return;
   }
   
   // Specific attribute validations
   if (attributes.sensitivityLevel === 'restricted' &&
       !identity.hasRole('senior-analyst')) {
       $evaluation.deny();
       return;
   }
   
   $evaluation.grant();
   

Best Practices

Keep your policy logic well-documented to ensure it remains understandable and compliant with security standards. Regularly test your policies and their combinations to confirm they perform as expected across various scenarios. This approach helps maintain a reliable and secure access control system over time.

sbb-itb-9d854a3

Policy and Permission Setup

Once you’ve created ABAC policies, the next step is to connect them to resources by setting up permissions in the Keycloak Admin Console.

Setting Up Permissions

Permission Type	Best Use Case	Complexity
Resource-based	Securing entire APIs or services	Low
Scope-based	Controlling specific actions (e.g., read/write)	Medium
Attribute-based	Context-driven dynamic access	High

Here’s how to set up permissions:

1. Create Resource Permission
   Go to the Authorization tab in your client settings. Select "Create Permission" and pick the type that fits your access needs. For sensitive actions, scope-based permissions are often the best choice.
2. Link Policies to Resources
   Assign policies to resources using a unanimous strategy to enhance security. For example:

   // Patient Records Permission
   Resource: "/api/patient-records"
   Scopes: ["view", "edit"]
   Policies: ["WorkingHoursPolicy", "DepartmentPolicy"]
   Decision Strategy: Unanimous
   

3. Configure Decision Strategies
   For high-security environments, use a unanimous decision strategy. This ensures all linked policies must approve access before it’s granted.

After setting these up, make sure to rigorously test your permissions to confirm everything works as intended.

Permission Testing

1. Basic Permission Testing
   In the Authorization section, use the Evaluation tab to test permissions. Start by testing simple scenarios and gradually increase complexity.
2. Advanced Testing Scenarios
   For example, verify that a user from the emergency department with a clearance level of 3 can access resources at 2:00 AM EST.
3. Troubleshooting Tips
   If permissions don’t work as expected:
   • Check evaluation logs for errors.
   • Confirm attribute names, paths, and policy links are accurate.
   • Test with different user profiles.
   • Keep in mind: 40% of ABAC errors are caused by issues like incorrect attribute casing or missing namespace prefixes (e.g., http://schemas.xmlsoap.org/ws/claims/department).

Skycloak offers a managed service that simplifies the testing process, cutting setup time by 70% while maintaining strong security.

With permissions set up and tested, you’re ready to dive into advanced ABAC examples.

Advanced ABAC Examples

These examples highlight how ABAC can manage complex and dynamic access scenarios.

Time-Based Rules

Time-based rules help control access based on specific timeframes, such as working hours or temporary permissions:

{
    "type": "script",
    "config": {
        "code": "var currentHour = new Date().getHours();
var currentDay = new Date().getDay();

// Allow access only during business hours (9 AM - 5 PM EST on weekdays)
if (currentHour >= 9 && currentHour < 17 && currentDay >= 1 && currentDay <= 5) {
    $evaluation.grant();
} else {
    $evaluation.deny();
}"
    }
}

Pairing time-based rules with other attributes can add another layer of security:

Time Condition	Use Case
Business Hours	Regular staff access
After Hours	On-call personnel
Weekend Hours	Maintenance windows

Next, consider location-based rules to further refine access control.

Location-Based Rules

Location-based rules restrict access depending on geographical or network parameters:

{
    "type": "js",
    "config": {
        "code": "var allowedIPs = ['10.0.0.0/8', '172.16.0.0/12'];
var clientIP = $evaluation.getContext().getIdentity().getAddress();

// Ensure 'isInRange' function is defined to evaluate IP ranges
if (allowedIPs.some(range => isInRange(clientIP, range))) {
    $evaluation.grant();
} else {
    $evaluation.deny();
}"
    }
}

These rules can be combined with enterprise tools for more sophisticated access management.

Enterprise ABAC with Skycloak

Enterprise-grade tools like Skycloak simplify ABAC implementation by offering advanced features, such as:

• Automated Policy Management
  Pre-built templates streamline setup for features like multi-factor authentication, role hierarchies, and department-specific permissions.
• Compliance-Ready Configurations
  Built-in support for GDPR and SOC2 ensures encrypted data storage, regional hosting (e.g., EU), and detailed audit trails.
• Advanced Integration Support
  Skycloak enables combining multiple access policies into a single, unified rule:

  // Example of a complex ABAC policy combining multiple attributes
  {
      "type": "aggregate",
      "logic": "POSITIVE",
      "decisionStrategy": "UNANIMOUS",
      "policies": [
          "time-based-access",
          "location-verification",
          "department-clearance",
          "risk-score-evaluation"
      ]
  }
  

This approach simplifies complex policy setups, making it easier to enforce strong access controls while meeting organizational needs.

Conclusion

Summary

To implement ABAC in Keycloak, focus on configuring resources, creating policies, and managing permissions carefully. By combining time-based and location-based rules, ABAC can address complex access scenarios while ensuring strong security measures.

Here are the main steps to follow:

• Resource Configuration
• Policy Development
• Permission Management
• Testing and Validation

Once these steps are complete, the next phase involves refining and improving your ABAC strategy for even better results.

Further Steps

Looking to strengthen security and streamline operations? Consider these strategies to take your ABAC implementation to the next level:

• Policy Reviews
  Regularly review ABAC policies to stay ahead of new security threats and adapt to changing business needs.
• Improved Monitoring
  Establish detailed logging and monitoring to track policy enforcement and detect potential security issues early.
• Enterprise Integration
  For advanced IAM needs, tools like Skycloak offer features that simplify ABAC management.

  Feature	Benefit
  Pre-built IAM Recipes	Quick setup for common authentication scenarios
  Automated Configuration	Minimized setup time and fewer configuration errors
  Cluster Management	Easier scaling and maintenance

Balancing security with operational efficiency is crucial for a successful ABAC implementation. Regular updates and monitoring will keep your system effective and ready for evolving business challenges.

FAQs

What makes Attribute-Based Access Control (ABAC) in Keycloak more flexible and secure compared to traditional Role-Based Access Control (RBAC)?

ABAC in Keycloak provides greater flexibility and granularity compared to traditional RBAC by using dynamic attributes to define access rules. Instead of relying solely on predefined roles, ABAC allows you to evaluate user attributes (e.g., department, location, or device type), resource attributes, and environmental conditions (e.g., time of access) to make access decisions.

This dynamic approach enhances security by enabling context-aware access control, ensuring users only access resources under specific conditions. For example, you can create policies that grant access to sensitive data only during business hours or restrict certain actions based on a user’s current location. By combining flexibility with detailed control, ABAC offers a more robust solution for modern, complex access management scenarios.

What are the best practices for testing and verifying ABAC policies in Keycloak?

To ensure your Attribute-Based Access Control (ABAC) policies in Keycloak work as intended, follow these best practices:

1. Start with clear requirements: Define the attributes, roles, and conditions that your policies should enforce. This helps avoid unnecessary complexity.
2. Use a test environment: Always test policies in a staging or development environment before applying them to production.
3. Simulate user scenarios: Test with different user accounts and attributes to validate that access is granted or denied correctly based on your policy rules.
4. Review logs and audit data: Use Keycloak’s built-in logging tools to monitor policy evaluations and identify potential issues.
5. Iterate and refine: Regularly review and update your policies to account for new requirements or changes in your system.

By following these steps, you can ensure your ABAC policies are both effective and secure.

How do time-based and location-based rules improve resource security in Keycloak’s ABAC system?

Time-based and location-based rules in Keycloak’s Attribute-Based Access Control (ABAC) system add an extra layer of security by ensuring access is granted only under specific conditions. Time-based rules restrict access to certain hours or dates, which is especially useful for limiting access during non-business hours or for temporary permissions. Location-based rules allow you to control access based on geographic location, ensuring that only users in approved regions can interact with your resources.

By combining these rules with Keycloak’s ABAC policies, you can create highly granular access controls tailored to your organization’s needs. This approach minimizes risks by reducing unauthorized access and aligning permissions with real-world operational requirements.

Related posts

• Keycloak SoD Policy Enforcement: Ultimate Guide
• Context-Aware Access Control in Keycloak