<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 12/07/2015 02:43 AM, Stian
Thorgersen wrote:<br>
</div>
<blockquote
cite="mid:CAJgngAcHvT1YNF0gYuFFGJMKc=OfX2ykt=aQFM89Y==j=GD56Q@mail.gmail.com"
type="cite">
<div dir="ltr">Added this comment to the previous thread, but
copy/pasting here:
<div><br>
</div>
<div><span style="font-size:12.8px">I was thinking a bit more
about trust between realms and I think that should be
limited to authentication only. An admin with certain roles
in one realm shouldn't necessarily have the same roles in
another realm. So I think we need either a user that can
exist in multiple realms or utilize identity brokering to
get "linked" users. I'm worried if we allow roles from one
realm to give admin permissions in another it will be hard
to get a full picture of who has access to the realm. It may
also give unintentional permissions. Also, if we introduce
admins that can only manage a "group" of users or roles that
specify what roles an admin can grant that would require
users in the specific realm to manage. </span><br>
</div>
</div>
</blockquote>
<br>
Again to use the Keystone comparison-other.<br>
<br>
A Domain in OpenStack is the top level entity for ownership. Under
domains in *identity* you have \users and groups. Under domains in
"resource" you have projects. I think projects most map to Realms
in Keycloak.<br>
<br>
<br>
A user is a resource to be managed by a domain. The fact that a
specific domain owns the user does not give the user any role
assignment in that domain; it is just ownership of the record.<br>
<br>
All role assignments are on the "resource" side of Keystone. A user
gets a role assignment on a project or a domain.<br>
<br>
<br>
Just about everything in Keystone has both a name and an id. For the
majority, these the IDs are UUIDs. An assignement is then a tuple:<br>
<br>
<br>
actor_id, target_id, role_id.<br>
<br>
Actor is either user or group.<br>
Target is either project or domain.<br>
Role is enforced by name, but assigned by ID.<br>
<br>
I've been calling this "Scoped RBAC" to contrast it with NIST, where
role assignments are not scoped to some namespace.<br>
<br>
<br>
The same would work for Keycloak: a Role is always assigned on a
Realm, never just a global role assignment.<br>
<br>
What becomes important, then, is that the application, or whatever
is requesting the set of roels for a user, get the right set for the
scope. When I log in to Wordpress for Marketing I get a different
set of roles listed from when I log in to Wordpress for Engineering.<br>
<br>
<br>
Now, I feel like Domains are bad extension, that we should have just
made projects hierarchical. Are Realms hierarchical in Keycloak?<br>
<br>
<br>
<br>
<br>
<blockquote
cite="mid:CAJgngAcHvT1YNF0gYuFFGJMKc=OfX2ykt=aQFM89Y==j=GD56Q@mail.gmail.com"
type="cite">
<div class="gmail_extra"><br>
<div class="gmail_quote">On 4 December 2015 at 17:23, Bill Burke
<span dir="ltr"><<a moz-do-not-send="true"
href="mailto:bburke@redhat.com" target="_blank">bburke@redhat.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">To
establish trust between realms I was thinking about a simple
table:<br>
<br>
realm|trusted-realm|role<br>
<br>
Here's some example records:<br>
<br>
test-realm|master|manage-clients<br>
test-realm|master|view-users<br>
<br>
means<br>
<br>
"test-realm" trusts the "master" realm, but they can only<br>
"manage-clients" and "view-users"<br>
<br>
The "role" column would just be the name of the realm, not
an id and<br>
would reference the "realm-management" client roles (which
will be moved<br>
to security-admin-console client).<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
Bill Burke<br>
JBoss, a division of Red Hat<br>
<a moz-do-not-send="true"
href="http://bill.burkecentral.com" rel="noreferrer"
target="_blank">http://bill.burkecentral.com</a><br>
_______________________________________________<br>
keycloak-dev mailing list<br>
<a moz-do-not-send="true"
href="mailto:keycloak-dev@lists.jboss.org">keycloak-dev@lists.jboss.org</a><br>
<a moz-do-not-send="true"
href="https://lists.jboss.org/mailman/listinfo/keycloak-dev"
rel="noreferrer" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-dev</a><br>
</font></span></blockquote>
</div>
<br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
keycloak-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:keycloak-dev@lists.jboss.org">keycloak-dev@lists.jboss.org</a>
<a class="moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/keycloak-dev">https://lists.jboss.org/mailman/listinfo/keycloak-dev</a></pre>
</blockquote>
<br>
</body>
</html>