PHPackages julabo/keycloak\_roles\_yourls - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. julabo/keycloak\_roles\_yourls ActiveYourls-plugin[Authentication & Authorization](/categories/authentication) julabo/keycloak\_roles\_yourls ============================== Restrict Keycloak Admin Access 1.1.1(5mo ago)07MITPHPPHP >=7.4.0 Since Dec 9Pushed 5mo agoCompare [ Source](https://github.com/julabo/keycloak_roles_yourls)[ Packagist](https://packagist.org/packages/julabo/keycloak_roles_yourls)[ RSS](/packages/julabo-keycloak-roles-yourls/feed)WikiDiscussions master Synced 1mo ago READMEChangelog (3)Dependencies (1)Versions (3)Used By (0) Keycloak Roles YOURLS Plugin ============================ [](#keycloak-roles-yourls-plugin) A YOURLS plugin that restricts administrative access based on Keycloak roles. Only users with the "User" role in Keycloak are allowed to access the YOURLS admin interface. Only users with the "Admin" role in Keycloak are allowed to manage plugins in the YOURLS admin interface. Features -------- [](#features) - **Role-based Access Control**: - Restricts YOURLS admin interface to users with the Keycloak "User" role - Restricts plugin management to users with the Keycloak "Admin" role - **JWT Token Validation**: Decodes and validates Keycloak ID tokens from user sessions - **Admin Menu Control**: Dynamically removes plugin menu items for unauthorized users - **Debug Support**: Comprehensive debugging output when YOURLS debug mode is enabled - **Session Integration**: Works seamlessly with existing OIDC/Keycloak authentication Requirements ------------ [](#requirements) - YOURLS URL shortener - Keycloak server with OIDC authentication configured - PHP 7.4.0 or higher - The [Keycloak Plugin](https://github.com/julabo/keycloak_yourls) installed and configured - Active PHP session with Keycloak ID tokens Installation ------------ [](#installation) 1. Download or clone this repository to your YOURLS plugins directory: ``` cd /path/to/yourls/user/plugins/ git clone https://github.com/julabo/keycloak_roles_yourls.git ``` 2. Activate the plugin through the YOURLS admin interface or by adding it to your configuration. Configuration ------------- [](#configuration) The plugin uses the following constants that can be customized: - `OIDC_ADMIN_ROLE`: The Keycloak role required for admin access (default: "Admin") - `OIDC_USER_ROLE`: The Keycloak role required for user access (default: "User") To change the required role, modify this constants in your `config.php`: ``` define('OIDC_ADMIN_ROLE', 'YourCustomAdminRole'); define('OIDC_USER_ROLE', 'YourCustomUserRole'); ``` How It Works ------------ [](#how-it-works) 1. **Token Validation**: The plugin checks for the presence of `oidc_id_token` in the user's session 2. **JWT Decoding**: Decodes the JWT payload to extract user roles 3. **Role Verification**: Checks if the user has the required role in `resource_access.yourls.roles` 4. **Access Control**: Blocks access to `plugins.php` and removes plugin menu items for unauthorized users Debugging --------- [](#debugging) Enable YOURLS debug mode to see detailed token and role information: ``` php define('YOURLS_DEBUG', true); ``` This will display: - Current script being accessed - Decoded ID token payload - User roles from Keycloak - Access control decisions Security Features ----------------- [](#security-features) - **403 Forbidden Response**: Unauthorized access attempts return proper HTTP status codes - **Menu Item Removal**: Plugin management links are hidden from unauthorized users - **Session-based Validation**: Relies on server-side session data, not client-side tokens Keycloak Configuration ---------------------- [](#keycloak-configuration) Ensure your Keycloak client is configured to: 1. Include the "yourls" resource in the access token 2. Assign appropriate roles to users under the "yourls" client scope 3. Configure OIDC authentication for your YOURLS instance Error Handling -------------- [](#error-handling) The plugin gracefully handles: - Missing or invalid JWT tokens - Malformed token payloads - Missing role information - Session initialization issues License ------- [](#license) This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for full license text. Support ------- [](#support) For issues, feature requests, or contributions, please visit the [GitHub repository](https://github.com/julabo/keycloak_roles_yourls). ### Health Score 31 — LowBetter than 68% of packages Maintenance73 Regular maintenance activity Popularity4 Limited adoption so far Community6 Small or concentrated contributor base Maturity36 Early-stage or recently created project Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~0 days Total 2 Last Release 153d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/3b7bfd4fc23a59188b07329a730d0ca969a2720493db2845e11e7d24a5f24e1f?d=identicon)[jleehr](/maintainers/jleehr) --- Top Contributors [![jleehr](https://avatars.githubusercontent.com/u/1804614?v=4)](https://github.com/jleehr "jleehr (6 commits)") ### Embed Badge ![Health badge](/badges/julabo-keycloak-roles-yourls/health.svg) ``` [![Health](https://phpackages.com/badges/julabo-keycloak-roles-yourls/health.svg)](https://phpackages.com/packages/julabo-keycloak-roles-yourls) ``` ### Alternatives [namshi/jose JSON Object Signing and Encryption library for PHP. 1.8k99.6M101](/packages/namshi-jose)[league/oauth1-client OAuth 1.0 Client Library 99698.8M106](/packages/league-oauth1-client)[bezhansalleh/filament-shield Filament support for `spatie/laravel-permission`. 2.8k2.9M88](/packages/bezhansalleh-filament-shield)[gesdinet/jwt-refresh-token-bundle Implements a refresh token system over Json Web Tokens in Symfony 70516.4M35](/packages/gesdinet-jwt-refresh-token-bundle)[league/oauth2-google Google OAuth 2.0 Client Provider for The PHP League OAuth2-Client 41721.2M118](/packages/league-oauth2-google)[illuminate/auth The Illuminate Auth package. 9327.3M1.0k](/packages/illuminate-auth) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)