12:07 p.m.
On 12/9/2013 8:50 AM, Bill Burke wrote:
I don't know why you'd want to sync with any master list, but
you could.
The Keycloak Admin REST interface is itself an application with roles
assign to it. Each application is itself a User. So you'd just assign
a Admin API role and the application could query for anything it wanted
(based on its permissions).
Most applications will inheritantly know which roles they require. Role
mappings are contained within the token they receive from the
auth-server. They idea is that security-wise, applications become
stateless. This is especially important for REST services that aim to
be completely stateless.
I'd go even further. I think an application will
ALWAYS know which
roles it requires. I just can't think of a time where that is not true
except for the degenerate case where the application is built without
any roles at all.
The example of selecting which roles should edit a particular record
doesn't make sense to me. Keycloak wouldn't define that because
Keycloak doesn't understand what those records are used for. The
application has to define those roles because the application
understands the context.
It seems to me that any sync that must be done should actually go the
other direction. A Keycloak subsystem (which I'm starting on today),
should attempt to find out which roles are declared in the application
and then let Keycloak know about them at deploy time.
On 12/8/2013 4:44 PM, Matt Casperson wrote:
> If I wanted my client application's UI to be able to authorise roles to
> perform certain actions, could I query a KeyCloak server for the master
> list?
>
> An example might be listing all the roles so I could select those that
> should be able to edit a particular record. So rather than manually
> syncing a list of roles between my application and KeyCloak, I would
> query the KeyCloak server for the current list of roles to ensure that I
> always have an accurate list.
>
> Regards
>
> Matthew Casperson
> RHCE, RHCJA # 111-072-237
>
<https://www.redhat.com/wapps/training/certification/verify.html?certNumbe...
> Engineering Content Services
> Brisbane, Australia
>
>
>
> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-dev
>