Re: [keycloak-user] getting resource owner and loggedin (identity) user attributes in evaluation context

Each user has one or more resource e.g. 'account' Each user is assigned one or more  agents.  (agent is different user in the system with role agent) I have added them in user attributes e.g let us say  there is user_a   who has account resource there are users with agent roles  say  'agent_a', 'agent_b', 'agent_c' In user_a  is attribute  I have added attribute allowed_agents =  [ 'agent_a' ,'agent_b'] in agent_a & agent_b  have attibutes  allowed_users =  ['user_a'] Now in policy evaluation   I want to ensure when agent_a & agent_b  try to access resource owned by user_a  they are allowed while agent_c is not allowed how do I access resource owners  attributes  and  or  identity ownes attributes I want to write a evaluation like something like this  is it possible to get $permission.resource.owner.attributes["allowed_agent"]to return ['agent_a','agent_b']or $identity.attributes['allowed_users']  to return ['user_a']   so that I can evaluate the match something like beowrule "Authorize Resource Owner"      dialect "mvel"      when         $evaluation : Evaluation(             $identity: context.identity,             $permission: permission,             $permission.resource.owner.attribute['allowed_agents'].indexOf($identity.id)        )      then          $evaluation.grant();  end  _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user