Guides Keycloak.AuthServices .NET library implementation for JWT Bearer/OIDC authentication, RBAC/resource authorization, Admin/Protection API SDKs, multi-tenancy, and dev tooling like .NET Aspire/OpenTelemetry.
npx claudepluginhub nikiforovall/keycloak-authorization-services-dotnet --plugin keycloak-authservicesThis skill uses the workspace's default tool permissions.
Choose your task and load the appropriate reference:
Guides ASP.NET Core authentication and authorization with JWT bearer tokens, OpenID Connect, ASP.NET Identity, policies, roles, claims, and API keys. For login, endpoint protection, and auth rules.
Guides Keycloak IAM administration: realm/user management, client configuration, authentication flows with OIDC/SAML, authorization policies, RBAC, security hardening, and troubleshooting.
Implementing API auth. Identity, OAuth/OIDC, JWT bearer, passkeys (WebAuthn), CORS, rate limiting.
Share bugs, ideas, or general feedback.
Choose your task and load the appropriate reference:
| Package | Purpose |
|---|---|
Keycloak.AuthServices.Authentication | JWT Bearer (Web API) and OpenID Connect (Web App) authentication |
Keycloak.AuthServices.Authorization | RBAC (realm/client roles), Authorization Server client, [ProtectedResource] attribute, organization authorization |
Keycloak.AuthServices.Sdk | Hand-written Admin REST API + Protection API HTTP clients |
Keycloak.AuthServices.Sdk.Kiota | Auto-generated (Kiota) Admin REST API client — full API coverage |
Keycloak.AuthServices.Common | Shared configuration (KeycloakInstallationOptions), claims utilities |
Keycloak.AuthServices.OpenTelemetry | Metrics and tracing instrumentation |
Keycloak.AuthServices.Aspire.Hosting | .NET Aspire KeycloakResource integration |
Keycloak.AuthServices.Templates | dotnet new project templates |
dotnet add package Keycloak.AuthServices.Authentication
dotnet add package Keycloak.AuthServices.Common
using Keycloak.AuthServices.Authentication;
var builder = WebApplication.CreateBuilder(args);
builder.Services.AddKeycloakWebApiAuthentication(builder.Configuration);
builder.Services.AddAuthorization();
var app = builder.Build();
app.UseAuthentication();
app.UseAuthorization();
app.MapGet("/", () => "Hello World!").RequireAuthorization();
app.Run();
// appsettings.json — "Keycloak" section (kebab-case from adapter config)
{
"Keycloak": {
"realm": "Test",
"auth-server-url": "http://localhost:8080/",
"ssl-required": "none",
"resource": "test-client",
"verify-token-audience": true,
"credentials": {
"secret": "your-client-secret"
}
}
}
All packages bind to "Keycloak" config section by default. Key properties:
| Property | Description |
|---|---|
realm | Keycloak realm name |
auth-server-url | Keycloak server URL (e.g., http://localhost:8080/) |
resource | Client ID |
ssl-required | none, external, or all |
verify-token-audience | Validate audience claim against resource |
credentials.secret | Client secret (confidential clients) |
Both kebab-case (Keycloak adapter format) and PascalCase are supported.
dotnet add package Keycloak.AuthServices.Authorization
builder.Services.AddKeycloakAuthorization(builder.Configuration)
.AddAuthorizationBuilder()
.AddPolicy("AdminOnly", policy => policy.RequireRealmRoles("admin"))
.AddPolicy("EditorOnly", policy => policy.RequireResourceRoles("editor"));
builder.Services
.AddKeycloakAuthorization()
.AddAuthorizationServer(builder.Configuration);
app.MapGet("/workspaces", () => "Hello World!")
.RequireProtectedResource("workspaces", "workspace:read");
dotnet add package Keycloak.AuthServices.Sdk
builder.Services.AddKeycloakAdminHttpClient(builder.Configuration);
app.MapGet("/users", async (IKeycloakUserClient client) =>
await client.GetUsers("my-realm"));
"Keycloak", override via configSectionName parameterIHttpClientBuilder for resilience, handlers, etc.Duende.AccessTokenManagement for service account tokensAddKeycloakAuthServicesInstrumentation() for metrics and tracingAddKeycloakContainer("keycloak") + AddRealm("Test") for local dev