Re: [keycloak-dev] Keycloak Modules developed for the Cloudtrust project

On Tue, 14 Aug 2018 at 12:03, Doswald Alistair <alistair.doswald(a)elca.ch&gt; wrote: This is great and pleased that you are maintaining this. We simply don't have the capacity to have this incorporated into Keycloak as we lack expertise on WS-Fed and have to many other things to maintain. Sounds interesting. Can you write some more details about this? In the past I've considered if we should have something like required roles to use to a client. That would by not allowing a user to authenticate with a client, but also could prevent adding audience for a service the user isn't allowed to access. Could perhaps take it one step further and prevent client scopes that users are not allowed to access. SAML JavaScript protocol mapper would be great. If you submit with tests and docs we'd love to have this in. Can you write some more details about this? In the past we've considered this, but not added it mainly for a few reasons, including: * What happens if there are changes while doing the export, we where thinking we'd have to pause the server from receiving requests during this export * We don't want a REST endpoint that can return credentials and other secrets. Then there's also the size of the export. It would have to store the export on disc, but then what about clustering. One potential would be to develop a tool that can be executed from anywhere that has access to the db. It would use Keycloak code base, but instead of starting a server it would allow things like running an export from the db, migrate the db, etc.