Re: [Hawkular-dev] define: tenant
Hi,
One possible solution is to have "users" and
"organizations", a la
Github. Users can be part of zero or more organizations and
organizations have one or more members. Data (git repos or resources)
belongs to either an user or an organization.
I think I like this idea.
- -> http://user:password@hawkular/resource/{resourceId}/metrics
all metrics for this specific resource, if the resource belongs to
the user or to an organization where the user is a member of
How would we model the user / org stuff? Well, that could probably
just become a part of inventory
Question is though: if a user has his own pet server and works as
part of an org. Do we want to prevent "leaking" org data to the private
project? Or is that purely up to the user?
For this scenario, I think the UI could be built with a
"context
switcher". This way, the user would have access to a dashboard with
resources from his main account and could switch to a dashboard with
resources from an organization. The backend, though, would not have
such a notion of "context". Either the user has access to the resource
or not (via the main account or via an organization).
Wouldn't the backend still need to know the context - and if only for
performance reason when the user wants to only see his personal resources?
The main disadvantage of this is that we have to also care about the
authorization, as we cannot rely on permission data coming from Keycloak.
Well, I guess a good deal of authorization needs to be done in some custom
code anyway and would not be covered by stock-JAAS, so it may not be that bad.
Heiko