Re: [Hawkular-dev] Relationship between Accounts and KeyCloak

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 03/26/2015 09:23 AM, Gary Brown wrote: > Just curious whether there have been discussions with the KeyCloak > project on the boundaries with Hawkular Accounts? Sort of. There were some discussions with some KC members about multi tenancy, which is really the "key" feature we need. Unfortunately, our model of multi tenancy doesn't match nicely with Keycloak's. Basically, Keycloak's multi tenancy capability is achieved in the form of realms: each realm is a tenant. In our case, that could work (we even contributed some code for allowing multi tenancy on the adapter side), *but*, there we have a scenario where users from one tenant would be given permission to access resources from another tenant. And there's no easy/pretty solution for that, as it's a conceptual mismatch, not a technical one. > Its just it seems like concepts such as Organizations and Roles > are generic and therefore should really be work contributed to > KeyCloak, leaving just the relationship from Orgs/Users to > resources as Accounts specific? Indeed. I sent an email to the PicketLink lead last week, as it's a component that already has all the features we need (on the Permissions API), including multi tenancy (with the concept of partitions, which relates to our 'organizations'). But the work in integrating PicketLink and Keycloak will still take some time. And this specific part of PicketLink is dependent on PicketLink IDM, conflicting with Keycloak, so, we can't use that as a standalone component. My plan is to ditch our custom code as soon as possible, as much as possible, to reuse what can be provided by specialized frameworks and tools. But "as soon as possible" is, as of now, "not soon enough for MVP ". - - Juca. _______________________________________________ hawkular-dev mailing list hawkular-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/hawkular-dev