Re: [keycloak-dev] inter-realm trust model

On 12/07/2015 02:43 AM, Stian Thorgersen wrote: Again to use the Keystone comparison-other. A Domain in OpenStack is the top level entity for ownership. Under domains in *identity* you have \users and groups. Under domains in "resource" you have projects. I think projects most map to Realms in Keycloak. A user is a resource to be managed by a domain. The fact that a specific domain owns the user does not give the user any role assignment in that domain; it is just ownership of the record. All role assignments are on the "resource" side of Keystone. A user gets a role assignment on a project or a domain. Just about everything in Keystone has both a name and an id. For the majority, these the IDs are UUIDs. An assignement is then a tuple: actor_id, target_id, role_id. Actor is either user or group. Target is either project or domain. Role is enforced by name, but assigned by ID. I've been calling this "Scoped RBAC" to contrast it with NIST, where role assignments are not scoped to some namespace. The same would work for Keycloak: a Role is always assigned on a Realm, never just a global role assignment. What becomes important, then, is that the application, or whatever is requesting the set of roels for a user, get the right set for the scope. When I log in to Wordpress for Marketing I get a different set of roles listed from when I log in to Wordpress for Engineering. Now, I feel like Domains are bad extension, that we should have just made projects hierarchical. Are Realms hierarchical in Keycloak?