I need to implement a requirement where a user cannot authorize if they have no matching roles from Keycloak into Drupal.
For this I can use the hook `hook_openid_connect_pre_authorize`
The problem is that mapping runs after this hook. Currently KeycloakRoleMatcher applies the rules directly on the Account, but I think we could add an method that allows you to just get the matching roles based on userinfo.
Is this something you would consider adding upstream to your module? If not, I can probably just decorate the service to support my use case.
Postponed: needs info
2.2
Code
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
Not exactly sure on how to handle this use case. Isn't that what you have the role mapper and "authenticated user" role for? You can give the authenticated user not a single permission.
Given this issue is over a year old I guess you also found your way around it?