Re: [keycloak-dev] Help with keycloak evaluation
On 10/30/2015 5:47 PM, Jorge M. wrote:
Hi,
I'm evaluating the keycloak to use in a multi-module system in
production and I need some help in the following topics:
- Is it possible to define groups of roles? For example, in
a scenario using groups as profiles and the roles as resources.
Not sure what you mean by "profiles" and "resources" could have
multiple meanings.
Currently, we don't have "groups" but have the concept of a "Composite
Role". A composite role can have multiple roles associated with it.
I am currently working on the concept of a group and this will be
released in 1.7 sometime in December. Groups can have roles associated
with them and attributes. Group members will inherit these roles and
attributes. Groups can be constructed in a hierarchy.
- Single login validation (only allow a single login session per user
to
avoid account sharing)
This is a feature that we don't have out of the box, but is something I
believe you would be able to code with our SPIs. Probably something we
should provide out of the box.
- Is there any sample federation provider for RDBMS?
There is a very simple non-RDBMS example for federation. You' have to
extrapolate how to marry that to a RDMS.
- Are you planning to develop an adapter to PHP web applications? Any
community adapter available?
We have 2 options for PHP (and other non-Java languages) at the moment:
#1 - Use SAML as the protocol. Front PHP with Apache. Use
mod-auth-mellon.
#2 - Use Keycloak Security Proxy. Its a small Java based web server
based on Undertow that forwards http requests and secures remote web
servers.
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com