Fotbiler.RuleGate.Keycloak
1.0.0
dotnet add package Fotbiler.RuleGate.Keycloak --version 1.0.0
NuGet\Install-Package Fotbiler.RuleGate.Keycloak -Version 1.0.0
<PackageReference Include="Fotbiler.RuleGate.Keycloak" Version="1.0.0" />
<PackageVersion Include="Fotbiler.RuleGate.Keycloak" Version="1.0.0" />
<PackageReference Include="Fotbiler.RuleGate.Keycloak" />
paket add Fotbiler.RuleGate.Keycloak --version 1.0.0
#r "nuget: Fotbiler.RuleGate.Keycloak, 1.0.0"
#:package Fotbiler.RuleGate.Keycloak@1.0.0
#addin nuget:?package=Fotbiler.RuleGate.Keycloak&version=1.0.0
#tool nuget:?package=Fotbiler.RuleGate.Keycloak&version=1.0.0
RuleGate Keycloak Integration
Optional Keycloak claim normalization and RuleGate subject mapping for ASP.NET Core applications.
This package does not configure authentication, contact Keycloak, or depend on
a Keycloak Admin SDK. The application remains responsible for validating
bearer tokens before RuleGate maps the authenticated ClaimsPrincipal.
Installation
dotnet add package Fotbiler.RuleGate.Keycloak --version 1.0.0
Compatibility
This package targets .NET Core 3.1 and every .NET release from 5 through 10. Legacy targets are package-tested for migration support but remain outside Microsoft security support.
Register the integration
services
.AddRuleGate()
.UseKeycloakSubjectMapping(options =>
{
options.ClientIds.Add("rulegate-api");
});
The mapping keeps identity-provider details outside the policy engine:
| Validated token input | RuleGate subject output |
|---|---|
sub |
Subject identifier |
realm_access.roles |
keycloak:realm:<role> |
Selected resource_access client roles |
keycloak:client:<client-id>:<role> |
Explicit permission claims |
Provider-independent permissions |
Only selected client IDs are mapped. RuleGate does not contact Keycloak to expand roles or infer permissions absent from the validated token.
Policy sources and atomic reload remain provider-independent; they do not contact Keycloak or change token-validation behavior. See the policy-source guide.
Authorization telemetry remains provider-independent and does not emit raw Keycloak roles, claims, subject identifiers, or token values. See the telemetry, performance, and concurrency guide.
See the Keycloak integration guide for role naming, client-role selection, and security boundaries.
See the document-approval reference application for the complete ASP.NET Core, Angular, Keycloak, SQLite, and YAML composition.
RuleGate packages
| Package | Purpose |
|---|---|
| Fotbiler.RuleGate.Abstractions | Public authorization contracts and extension abstractions |
| Fotbiler.RuleGate.Core | Local fail-closed authorization engine and built-in evaluators |
| Fotbiler.RuleGate.Manifest | YAML manifest loading, validation, and compilation |
| Fotbiler.RuleGate.AspNetCore | ASP.NET Core integration and attribute enrichment |
| Fotbiler.RuleGate.Cli | Manifest validation, policy testing, generation, and CI usage |
| Fotbiler.RuleGate.Keycloak | Optional Keycloak claim normalization and subject mapping |
Security
Authentication and token validation remain application responsibilities. Map only explicitly trusted realm roles, client roles, and permission claims into RuleGate subjects.
Report suspected vulnerabilities through the private security reporting process.
License
RuleGate is licensed under the MIT License.
| Product | Versions Compatible and additional computed target framework versions. |
|---|---|
| .NET | net5.0 is compatible. net5.0-windows was computed. net6.0 is compatible. net6.0-android was computed. net6.0-ios was computed. net6.0-maccatalyst was computed. net6.0-macos was computed. net6.0-tvos was computed. net6.0-windows was computed. net7.0 is compatible. net7.0-android was computed. net7.0-ios was computed. net7.0-maccatalyst was computed. net7.0-macos was computed. net7.0-tvos was computed. net7.0-windows was computed. net8.0 is compatible. net8.0-android was computed. net8.0-browser was computed. net8.0-ios was computed. net8.0-maccatalyst was computed. net8.0-macos was computed. net8.0-tvos was computed. net8.0-windows was computed. net9.0 is compatible. net9.0-android was computed. net9.0-browser was computed. net9.0-ios was computed. net9.0-maccatalyst was computed. net9.0-macos was computed. net9.0-tvos was computed. net9.0-windows was computed. net10.0 is compatible. net10.0-android was computed. net10.0-browser was computed. net10.0-ios was computed. net10.0-maccatalyst was computed. net10.0-macos was computed. net10.0-tvos was computed. net10.0-windows was computed. |
| .NET Core | netcoreapp3.1 is compatible. |
-
.NETCoreApp 3.1
- Fotbiler.RuleGate.AspNetCore (>= 1.0.0)
-
net10.0
- Fotbiler.RuleGate.AspNetCore (>= 1.0.0)
-
net5.0
- Fotbiler.RuleGate.AspNetCore (>= 1.0.0)
-
net6.0
- Fotbiler.RuleGate.AspNetCore (>= 1.0.0)
-
net7.0
- Fotbiler.RuleGate.AspNetCore (>= 1.0.0)
-
net8.0
- Fotbiler.RuleGate.AspNetCore (>= 1.0.0)
-
net9.0
- Fotbiler.RuleGate.AspNetCore (>= 1.0.0)
NuGet packages
This package is not used by any NuGet packages.
GitHub repositories
This package is not used by any popular GitHub repositories.
| Version | Downloads | Last Updated |
|---|---|---|
| 1.0.0 | 72 | 8/1/2026 |
| 1.0.0-rc.1 | 125 | 8/1/2026 |
| 0.9.0-preview.4 | 103 | 7/31/2026 |
| 0.9.0-preview.3 | 40 | 7/31/2026 |
| 0.9.0-preview.2 | 53 | 7/31/2026 |
| 0.9.0-preview.1 | 45 | 7/31/2026 |
| 0.8.0-preview.2 | 46 | 7/31/2026 |
| 0.7.0-preview.2 | 172 | 7/29/2026 |
| 0.7.0-preview.1 | 51 | 7/29/2026 |
| 0.6.0-preview.2 | 43 | 7/29/2026 |
| 0.6.0-preview.1 | 46 | 7/29/2026 |
| 0.5.0-preview.2 | 56 | 7/29/2026 |
| 0.5.0-preview.1 | 53 | 7/28/2026 |
Publishes the stable RuleGate 1.0 API and coordinated NuGet package family after release-candidate API freeze, security hardening, reproducibility, and package-only compatibility verification.