Re: [keycloak-dev] RFC: organizations
On 07/28/2015 09:04 AM, Stian Thorgersen wrote:
----- Original Message -----
> From: "Juraci Paixão Kröhling" <juraci(a)kroehling.de>
> To: keycloak-dev(a)lists.jboss.org
> Sent: Tuesday, 28 July, 2015 8:12:14 AM
> Subject: Re: [keycloak-dev] RFC: organizations
>
> We have a *very* similar use case and we have implemented the notion of
> "Organizations" (and "Personas") in Hawkular, in a module named
> "Hawkular Accounts". In our case, an user can belong to multiple
> organizations, and can have different roles within each organization
> ("Super User" in "Operations", but "Monitor" on
"Marketing").
Can you not already model that in Keycloak by having a separate clients for
"Operations" and "Marketing" with the corresponding roles?
With the current features related to Clients, it might actually be
possible. Would it be possible to restrict which users can login with
which clients? For instance:
- jdoe registers
- jdoe creates "Acme, Inc" (and is then super user there)
- jsmith registers
- jsmith creates "Red Hat, Inc" (and is then super user there)
- jdoe invites jsmith to "Acme, Inc" to be "Monitor" there
So:
- jdoe should never have access to "Red Hat, Inc"
- jsmith should have access to:
- his "own" resources (not part of any organization)
- resources owned by "Acme, Inc" (as Monitor)
- resources owned by "Red Hat, Inc" (as Super User).
This scenario is the main reason why we have Hawkular Accounts between
the individual HK components and Keycloak. With this covered, I think
pretty much all of the other use cases can be worked out quite easily.
- Juca.