8:23 a.m.
I strongly believe that applications should be under a separate top-level menu.
- An application is configured to use a realm, it's not a child of the realm
- A developer may know what application he's looking for, but not know what realm it
belongs to
I also believe that a first time user should be able to create an application without
having to create a realm first. There are several options for this:
- Create a default realm for a user when the first application is created
- Embed the creating realm form into the creating application form / this should require
very little additional work on the UI level if Angular services and partials are done
correctly
Having applications as a separate entity is also vital if for example an MBaaS solution
should consume Keycloak and reuse parts of the admin console. In this case an application
doesn't only have a security realm, and security configuration, it also has data
configuration, push notification configuration, etc.
----- Original Message -----
From: "Bill Burke" <bburke(a)redhat.com>
To: keycloak-dev(a)lists.jboss.org
Sent: Thursday, 12 September, 2013 1:38:17 PM
Subject: [keycloak-dev] relationship between application and realm
I want to bring this up again because I feel strongly about it. Having
"Application" separate from "Realm" or a top-level-menu item, is not
a
good thing for many reasons. I'm talking about this idea of only
creating an Application for single apps through the admin UI and setting
up everything based only on the idea of an Application with no knowledge
of what a realm is.
* Realm is core to the implementation.
* Once you want to do SSO, you have to know what a realm is. This idea
of merging/exporting/importing an Application into a Realm seems just
very complex to me. I'm of the strong opinion that its just not a great
idea because SSO (and Single Log Out) is one of our key features.
* You're not creating an application within Keycloak, you're securing an
application. A Realm really pertains to the auth-server. Application
pertains to the
* JBoss, Tomcat, and Jetty, really most Java developers already know
what a Realm is. Even Basic Auth has the concept of a Realm. Realm is
just such a core concept to security.
* Removing the concept of a Realm for a single-app domain, doesn't
really simplify much for the user. All we're really asking the user to
do is specify a name for the realm and configure providers and manage
users at the realm level.
* Having a noticably different UI for a one-off-app vs. a multi-app
realm is just confusing to the user. It creates more work for us, for
very little gain.
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev