VerifiedPlugin
Development
claude-code-rules
A collection of Claude Code recommendations and practices. Learn practical techniques to enhance your AI-assisted development workflow with Claude Code.
27 skills
@nikiforovallSecurity
Plugin
keycloak-authservices
🔐 Easy Authentication and Authorization with Keycloak in .NET.
Plugin Signal61/100Solid
maintained66
capable29
documented100
adopted60
Install on Claude Code
> /plugin marketplace add NikiforovAll/keycloak-authorization-services-dotnet> /plugin install keycloak-authservices@keycloak-authservices
What's inside
Skills
3/aspireOrchestrates Aspire distributed applications using the Aspire CLI for running, debugging, and managing distributed apps. USE FOR: aspire start, aspire stop, start aspire app, aspire describe, list aspire integrations, debug aspire issues, view aspire logs, add aspire resource,/keycloak-administrationKeycloak identity and access management (IAM) administration guidance — realm management, client configuration, authentication flows, authorization policies, security hardening, and troubleshooting. Use when configuring Keycloak, setting up SSO, managing realms/clients,/keycloak-auth-servicesImplementation guide for Keycloak.AuthServices .NET library — authentication (JWT Bearer, OIDC, RFC 8414), authorization (RBAC, resource protection, Authorization Server, organizations, multi-tenancy), Admin REST API SDK, Protection API SDK, and developer experience tooling
Badges
6
README
1Keycloak.AuthServices
🔐 Easy Authentication and Authorization with Keycloak in .NET.
| Package | Version | Description |
|---|---|---|
Keycloak.AuthServices.Authentication |  | Keycloak Authentication JWT + OIDC |
Keycloak.AuthServices.Authorization |  | Authorization Services. Use Keycloak as authorization server |
Keycloak.AuthServices.Authorization.TokenIntrospection |  | Token introspection for lightweight access tokens (KC 24+) |
Keycloak.AuthServices.Authorization.Uma |  | UMA 2.0 support — permission ticket challenges, RPT exchange |
Keycloak.AuthServices.Sdk |  | HTTP API integration with Keycloak |
Keycloak.AuthServices.Sdk.Kiota |  | HTTP API integration with Keycloak based on OpenAPI |
Keycloak.AuthServices.OpenTelemetry |  | OpenTelemetry support |
Keycloak.AuthServices.Templates |  | dotnet new templates |
Documentation
For Developer Documentation see: https://nikiforovall.github.io/keycloak-authorization-services-dotnet
API Reference
See: https://nikiforovall.github.io/keycloak-authorization-services-dotnet-docs
Getting Started
Install packages:
dotnet add package Keycloak.AuthServices.Authentication
// Program.cs
using Keycloak.AuthServices.Authentication;
var builder = WebApplication.CreateBuilder(args);
builder.Services.AddKeycloakWebApiAuthentication(builder.Configuration);
builder.Services.AddAuthorization();
var app = builder.Build();
app.UseAuthentication();
app.UseAuthorization();
app.MapGet("/", () => "Hello World!").RequireAuthorization();
app.Run();
In this example, configuration is based on appsettings.json.
//appsettings.json
{
"Keycloak": {
"realm": "Test",
"auth-server-url": "http://localhost:8080/",
"ssl-required": "none",
"resource": "test-client",
"verify-token-audience": false,
"credentials": {
"secret": ""
},
"confidential-port": 0
}
}
Example - Add Authorization
With Keycloak.AuthServices.Authorization, you can implement role-based authorization in your application. This package allows you to define policies based on roles. Also, you can use Keycloak as Authorization Server. It is a powerful way to organize and apply authorization polices centrally.
var builder = WebApplication.CreateBuilder(args);
var host = builder.Host;
var configuration = builder.Configuration;
var services = builder.Services;
services.AddKeycloakWebApiAuthentication(configuration);
services.AddAuthorization(options =>
{
options.AddPolicy("AdminAndUser", builder =>
{
builder
.RequireRealmRoles("User") // Realm role is fetched from token
.RequireResourceRoles("Admin"); // Resource/Client role is fetched from token
});
})
.AddKeycloakAuthorization(configuration);
var app = builder.Build();
app.UseAuthentication();
app.UseAuthorization();
app.MapGet("/hello", () => "[]")
.RequireAuthorization("AdminAndUser");
app.Run();
Example - Invoke Admin API
var services = new ServiceCollection();
services.AddKeycloakAdminHttpClient(new KeycloakAdminClientOptions
{
AuthServerUrl = "http://localhost:8080/",
Realm = "master",
Resource = "admin-api",
});
var sp = services.BuildServiceProvider();
var client = sp.GetRequiredService<IKeycloakRealmClient>();
var realm = await client.GetRealmAsync("Test");
Build and Development
dotnet cake --target build
dotnet cake --target test
dotnet pack -o ./Artefacts
File tree
1189NikiforovAll/keycloak-authorization-services-dotnetView on GitHub
.claude/
.claude-plugin/
marketplace.json
plugin.json
settings.json
skills/
aspire/
SKILL.md
.config/
dotnet-tools.json
.editorconfig
.gitattributes
.github/
agents/
keycloak-expert.agent.md
aw/
actions-lock.json
release-drafter.yml
workflows/
build.yml
deploy-docs.yml
keybot.lock.yml
keybot.md
release-drafter.yml
.gitignore
.gitmodules
.husky/
pre-commit
task-runner.json
.vscode/
settings.json
tasks.json
AGENTS.md
build.cake
CLAUDE.md
CODE_OF_CONDUCT.md
docs/
.vitepress/
config.mts
V1/
Authentication.README.md
Authorization.README.md
README.md
Sdk.README.md
admin-rest-api/
access-token.md
admin-api-kiota.md
admin-api-openapi.md
admin-api-reference.md
admin-api.spec.md
admin-rest-api.md
group-client.md
realm-client.md
user-client.md
ai/
skills.md
assets/
uma-resource-sharing-approve.gif
uma-resource-sharing-denied.gif
uma-resource-sharing-login.gif
authorization/
authorization-server.md
organizations.md
policy-provider.md
protected-resource-builder-mvc.md
protected-resource-builder.md
resources-api.md
resources-client-reference.md
resources-client.md
resources.md
token-introspection.md
blogs.md
configuration/
configuration-authentication.md
configuration-authorization.md
configuration-keycloak.md
design-principles.md
devex/
aspire.md
templates.md
examples/
aspire-web-api.md
auth-clean-arch.md
auth-getting-started.md
authorization-getting-started.md
client-secret-jwt.md
organization-authorization.md
resource-authorization.md
token-introspection.md
uma-resource-sharing.md
web-api-blazor.md
web-app-mvc.md
getting-started.md
index.md
introduction.md
migration.md
opentelemetry.md
protection-api/
policy-client.md
protected-resource-client.md
protection-api-reference.md
protection-api.md
uma.md
public/
apple-touch-icon.png
assets/
authz-arch-overview.png
evaluate-permissions-for-admin.png
my-workspace-resource.png
read-workspace-permission.png
favicon-16x16.png
favicon-32x32.png
favicon.ico
icon.png
logo.svg
site.webmanifest
qa/
recipes.md
troubleshooting.md
global.json
KeycloakAdminApiClient.cs
KeycloakAuthorizationServicesDotNet.slnx
LICENSE.md
Nuget.Config
package-lock.json
package.json
README-plugin.md
README.md
samples/
AuthGettingStarted/
ApplicationLogger.cs
appsettings.Development.json
appsettings.json
assets/
.env
token.http
AuthGettingStarted.csproj
docker-compose.yml
Program.cs
Properties/
launchSettings.json
README.md
ServiceCollectionExtensions.cs
AuthorizationAndCleanArchitecture/
Application/
Authorization/
Authorization.Abstractions/
ICurrentUserService.cs
IIdentityService.cs
Impl/
CurrentUserService.cs
IdentityService.cs
NullIdentityService.cs
NullUserService.cs
AuthorizationBehavior.cs
AuthorizeAttribute.cs
AuthorizeProtectedResourceAttribute.cs
ForbidenAccessException.cs
IRequestWithResourceId.cs
Commands/
CreateWorkspaceCommand.cs
DeleteWorkspaceCommand.cs
DeleteWorkspaceCommandAOP.cs
Queries/
GetWorkspaceByIdQuery.cs
GetWorkspacesQuery.cs
ApplicationLogger.cs
appsettings.Development.json
appsettings.json
assets/
.env
Authorization.postman_collection.json
docker_postgres_init.sql
run.http
token.http
AuthorizationAndCleanArchitecture.csproj
Controllers/
ApiControllerBase.cs
AuthZController.cs
KeycloakAdminController.cs
PoliciesPlayground.cs
WorkspacesController.cs
WorkspacesController2.cs
Data/
ApplicationDbContext.cs
IApplicationDbContext.cs
Workspace.cs
DatabaseUtils.cs
docker-compose.yml
Filters/
ApiExceptionFilterAttribute.cs
keycloak/
keycloak.json
realm-authz.json
workspace-authz-authz-config.json
keycloak2.json
PolicyConstants.cs
Program.cs
Properties/
launchSettings.json
README.md
ServiceCollectionExtensions.cs
AuthorizationGettingStarted/
appsettings.Development.json
appsettings.json
assets/
run.http
AuthorizationGettingStarted.csproj
docker-compose.yml
Program.cs
Properties/
launchSettings.json
ServiceCollectionExtensions.Auth.cs
ServiceCollectionExtensions.Logging.cs
ServiceCollectionExtensions.OpenApi.cs
Blazor/
assets/
realm-export.json
Client/
_Imports.razor
App.razor
Blazor.Client.csproj
Pages/
Authentication.razor
FetchData.razor
Index.razor
Program.cs
Properties/
launchSettings.json
Shared/
LoginDisplay.razor
MainLayout.razor
MainLayout.razor.css
NavMenu.razor
NavMenu.razor.css
RedirectToLogin.razor
wwwroot/
css/
app.css
bootstrap/
bootstrap.min.css
bootstrap.min.css.map
open-iconic/
font/
FONT-LICENSE
css/
open-iconic-bootstrap.min.css
fonts/
open-iconic.eot
open-iconic.otf
open-iconic.svg
open-iconic.ttf
open-iconic.woff
ICON-LICENSE
README.md
index.html
docker-compose.yml
Server/
appsettings.Development.json
appsettings.json
Blazor.Server.csproj
Controllers/
WeatherForecastController.cs
Pages/
Error.cshtml
Error.cshtml.cs
Program.cs
Properties/
launchSettings.json
Shared/
Blazor.Shared.csproj
WeatherForecast.cs
ClientSecretJwt/
appsettings.Development.json
appsettings.json
assets/
run.http
ClientSecretJwt.csproj
ClientSecretJwtAssertionService.cs
docker-compose.yml
KeycloakConfiguration/
Test-realm.json
Test-users-0.json
Program.cs
Properties/
launchSettings.json
README.md
Directory.Build.props
Directory.Packages.props
GettingStarted/
appsettings.Development.json
appsettings.json
assets/
.env
main.http
GettingStarted.csproj
Program.cs
Properties/
launchSettings.json
GettingStartedAndAspire/
Api/
Api.csproj
appsettings.Development.json
appsettings.json
Program.cs
Properties/
launchSettings.json
AppHost/
AppHost.csproj
appsettings.Development.json
appsettings.json
KeycloakConfiguration/
Test-realm.json
Test-users-0.json
Program.cs
Properties/
launchSettings.json
aspire.config.json
GettingStartedAndAspire.slnx
ServiceDefaults/
Extensions.cs
ServiceDefaults.csproj
OAuthServerMetadata/
appsettings.Development.json
appsettings.json
assets/
get-token.sh
run.http
verify-metadata.sh
docker-compose.yml
KeycloakConfiguration/
Test-realm.json
Test-users-0.json
OAuthServerMetadata.csproj
Program.cs
Properties/
launchSettings.json
README.md
OrganizationAuthorization/
appsettings.Development.json
appsettings.json
assets/
get-token.sh
run.http
seed.sh
docker-compose.yml
KeycloakConfiguration/
Test-realm.json
Test-users-0.json
OrganizationAuthorization.csproj
Program.cs
Properties/
launchSettings.json
README.md
ResourceAuthorization/
appsettings.Development.json
appsettings.json
Controllers/
WorkspacesController.cs
WorkspaceUsersController.cs
docker-compose.yml
KeycloakConfiguration/
clients/
admin-api.json
test-client-auth-rules.json
Test-realm.json
Test-users-0.json
Models/
User.cs
Workspace.cs
Program.cs
Properties/
launchSettings.json
README.md
ResourceAuthorization.csproj
SwaggerExtensions.cs
WorkspaceService.cs
TokenIntrospection/
appsettings.Development.json
appsettings.json
assets/
get-token.sh
run.http
seed.sh
test-modes.sh
docker-compose.yml
KeycloakConfiguration/
Test-realm.json
Test-users-0.json
Program.cs
Properties/
launchSettings.json
README.md
TokenIntrospection.csproj
UmaResourceSharing/
AppHost/
AppHost.csproj
appsettings.Development.json
appsettings.json
KeycloakConfiguration/
... 1293 moreMore Flows by @nikiforovall.
@nikiforovallFAQ
keycloak-authservices is a Claude Code plugin with 3 hand-picked skills for security work, indexed on Flowy. Install it with the command on its page. It includes aspire, keycloak-administration, keycloak-auth-services. Its skills do not fire on their own yet. Request auto-invocation to have Flowy route them as you prompt. Free and open source.
- What is keycloak-authservices?
- 🔐 Easy Authentication and Authorization with Keycloak in .NET.
- How do I install keycloak-authservices?
- Run these in Claude Code: /plugin marketplace add NikiforovAll/keycloak-authorization-services-dotnet then /plugin install keycloak-authservices@keycloak-authservices. Then prompt normally.
- Does keycloak-authservices auto-invoke its skills?
- Not yet. It is indexed on Flowy as a plain plugin. Request auto-invocation on its page and Flowy will route its skills for you as you prompt.
- Is keycloak-authservices free?
- Yes. Flowy is free and open source, with nothing gated. You can read every skill in full before you install.