[keycloak-user] Groups/Roles/Clients best practices
Hi all,
first a little introduction. I am currently tasked with deploying Keycloak as
an SSO solution for a middle-sized NGO. Keycloak seems like a perfect solution
for us, with capabilities to scale and support more elaborate set-ups as we
grow and new needs arise.
We will have a few thousand users in there, with varying access levels to
different tools we use. And we need to make our setup as simple as possible
(so that it's manageable) -- but not simpler.
We are also going to have several clients -- software that we want to
authenticate against our Keycloak instance. Each of these will have certain
resources available only to certain groups of users. For example, a discussion
forum might have certain topics locked and available only to certain groups;
or a data storage solution might have a certain set of data only available to
a certain group of users.
Now, most of the time, if a user is a member of a particular group, they get
access to all resources locked to this particular group in each of these
clients. However, we do have use-cases where a user should have access to a
group-locked resource in client A, but not in client B (while keeping access
to the more generally available resources in both clients).
This gets complicated fast, and we'd like to ask if there are any best
practices we could look into and follow?
Right now my thinking is to have client roles related to each of the sets of
locked-down resources; then a realm-wide composite role getting all of the
client roles together for easier management of the most common use-case; then
a group to easily manage users who get the composite realm role (and thus, all
the client roles).
This way we could manage the most common use-case easily, but if there's a
user who should have access only to the particular locked-down resources in
*some* of the clients, we can also grant these more granularly. The actual
software that authenticates/authorizes against Keycloak would only have to
look for the client role, and wouldn't have to care about the realm role or
the group, or anything else.
Does this make sense? Perhaps we're missing some obvious solution, or perhaps
we're making some wrong assumptions somewhere.
Any suggestions much appreciated!
--
Pozdravi,
rashiq