[keycloak-dev] User Managed Access and UMA 2.0 Changes

Hey All, Sorry for the long message, but I tried to highlight some important bits of what I'm doing :) I'm not done yet, so here are the ideas I'm considering .... I'm almost done with the initial changes to get the user managed access bits of UMA. Basically, this is about providing the backbone in order to support use cases such as resource sharing, authorization flows and users capable of managing their own resources. A really interesting feature set for IoT use cases as well those looking for giving more privacy control to their users (not only the security). In a nutshell, we have now a new entity in our model: * PermissionTicketEntity This entity holds all information we need in order to know which resource/scope was requested and when. Plus any additional claims the RS wants to associated with a permission request. This entity will allow us to perform: * Queries to obtain the person/entity that need to approve a permission request * Queries to obtain the person/entity looking for access * Queries to obtain the resources/scopes being requested * For how long a permission is valid * Which claims (contextual data pushed by the RS when issuing a permission ticket) are associated with a permission request and need to be approved by the owner and enforced by the RS. As you know, the UMA flow starts with a client trying to access a resource protected by a RS. At this moment the RS issues a *permission ticket* which then is returned to the client to give him a chance to obtain the RPT (token with the actual permissions) from the AS. Two things here: * Only resources that support "user/owner managed access" are supposed to have permission tickets persisted * The RS can set additional claims to the permission ticket in order to provide contextual data for policies and let them take any decision considering this data. E.g: I need to withdraw some money from my wife's bank account, but she just want to let me do it if the amount is <= $100 dollars. Basic sharing will be based on a simple approval/reject of a permission request (permission ticket). Please, let me know what you think. Thanks.