Keycloak Composite Roles
You create keycloak composite roles by linking smaller child roles to one parent role. When you assign the parent role to a user, they get all child roles too. Teams use this feature to bundle job tasks into a single group role. This saves time when a new person joins your team or changes jobs. Still, adding too many child roles to one parent creates broad access. Users end up with extra rights they do not need for daily work. How keycloak composite roles work In Keycloak, a standard role rep
Keycloak + Lambda Execution Roles: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You create keycloak composite roles by linking smaller child roles to one parent role. When you assign the parent role to a user, they get all child roles too. Teams use this feature to bundle job tasks into a single group role. This saves time when a new person joins your team or changes jobs. Still, adding too many child roles to one parent creates broad access. Users end up with extra rights they do not need for daily work.
How keycloak composite roles work
In Keycloak, a standard role represents a single right or job function. You can make any standard role into a composite role at any time. To do this, you pick a base role and attach other roles to it. Those attached roles can come from the global realm level or specific apps.
Once linked, the parent role acts as a folder for all child roles. When a user logs in, Keycloak checks the parent role and finds every child. It then puts all these roles into the user token at once. The target app reads the token and sees the full list of child roles. The app does not need to know how the parent role grouped them.
You can also nest roles inside other composite roles to build a deep tree. For example, a lead developer role might hold a junior developer role inside it. That junior role might hold read roles for three different web apps. When you update the junior role, every lead developer gets the change right away. This setup makes large role updates fast for your admin team.
Managing realm and client roles together
Keycloak splits roles into two main buckets: realm roles and client roles. Realm roles sit at the top level and work across every app you own. Client roles belong to one specific app and control actions inside that single tool. You can mix both types when you build a composite role for your team.
Many teams create a realm role that matches a real job title. Then they attach specific client roles from each app that job needs to use. For instance, a support role might include read rights from the billing app. It might also include ticket update rights from the help desk app. The admin only assigns one realm role, and the user gets both client roles.
Keycloak + Lambda Execution Roles: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
You must watch out for token size when you link many client roles together. Every child role adds text to the token that goes over the network. If a parent role holds dozens of child roles, the token grows very large. Large tokens can break web requests when they hit size limits in browsers. Keep your role groups small and focused on daily tasks to avoid this issue.
What role groups solve and what they leave open
Role groups cut down the manual work of setting up new team members. Admins do not need to click through ten different apps for each new hire. They assign one parent role and know the user has the right starting setup. When someone leaves a team, taking away that one role removes all child rights.
Yet identity roles only control who can log in and open a tool. Once the user gets inside a database or server, Keycloak steps out of the way. A composite role cannot see or check the exact queries a user runs next. It cannot stop a developer with write rights from dropping a full table by mistake. It also cannot mask private emails, phone numbers, or card numbers in query results. True safety requires checking actions in flight, not just checking roles at login time.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
Can a client role be a composite role in Keycloak?
Yes, both realm roles and client roles can act as composite parent roles. A client role can hold other client roles or even global realm roles.
What happens when you remove a child role from a composite role?
Every user with that parent role loses the removed child role on their next login. You do not need to edit each user profile one by one.
Do nested composite roles hurt login speed?
Deep nesting makes Keycloak work harder to build the role list during login. Keep your role trees flat so logins stay fast and easy to audit.