Re: [keycloak-user] UMA and large resource sets
Hi,
You may be interested in the discussions [1] we had in the past with the
community about data filtering/security. It should give you an idea about
what we are missing and how to extend some of our capabilities to filter
data on your application based on the permissions granted by Keycloak.
It seems you can benefit from "pushed claims" in order to communicate a
filter from your policies to your application so that you filter
(dynamically) resources based on the user making a request. For the second
part where you want to obtain shared resources, you could take a look at
this quickstart [2]. Unfortunately, we don't have the API that allows you
to manage shared resources documented.
[1]
https://lists.jboss.org/pipermail/keycloak-user/2018-November/016083.html
[2]
https://github.com/keycloak/keycloak-quickstarts/blob/latest/app-authz-ph...
Regards.
Pedro Igor
On Wed, Aug 21, 2019 at 8:14 AM Asbjørn Dyhrberg Thegler <asbjoern(a)gmail.com>
wrote:
Hello there,
I am implementing a Node.js resource server and I currently struggle with
figuring out how to let a user list all their resources from a specifict
resource set.
For example, a user can GET /activities and get all their own activities,
but not other users. I am not certain of how to create a UMA permission
ticket for that request, since don't already know the IDs of the users
activities. Further, the user could have access to other users activities
through resource sharing. This list is potentially very large, (as in
thousands of IDs), and I don't imagine putting that large a JWT in a header
is a good idea either.
What is the recommended way to handle this?
I am wondering if I should let the resource server itself query KeyCloak
for a list of IDs for all its own activities and activities shared with the
user - but I can't seem to figure out what API endpoint that lets me do
this in KeyCloak 6.0.1, since the Entitlement API has been deprecated.
Thanks for your help, I really enjoy working with KeyCloak so far. :)
Regards, Asbjørn
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user