7:41 a.m.
Hi there,
I'm Alex's coworker and I'll be working on this too.
We were just discussing your idea, and it seems to fit our requirements.
As far as we have seen, keycloak already has a realm-admin concept.
Whenever a realm "R" is created, it creates a R-realm application with
a bunch of default roles (manage-users, manage-roles, etc.) into the
realm master.
We are currently thinking if we could mimic this structure for
applications. What do you think?
I had an idea a while back that is a simple way to achieve what
you're asking for. Th> e idea would be to only allow an admin to grant roles that
the admin has access to.
Basically:> * A user with admin (super user) role can grant any
roles (we would need to add a per-> realm super user role)
* A user with the role manage-users and some roles on app1 can only
grant other users > the roles on app1
* A user with the role manage-users and some roles on app2 can only
grant other users > the roles on app2
This is something we should add in either case (to prevent users
granting
themselves more access). Would it solve your problems?
7:44 a.m.
New subject: Application Management
----- Original Message -----
From: "Thiago Presa" <thiago.addevico(a)gmail.com>
To: stian(a)redhat.com
Cc: keycloak-user(a)lists.jboss.org
Sent: Tuesday, 24 March, 2015 1:41:16 PM
Subject: Re: [keycloak-user] Application Management
Hi there,
I'm Alex's coworker and I'll be working on this too.
We were just discussing your idea, and it seems to fit our requirements.
As far as we have seen, keycloak already has a realm-admin concept.
Whenever a realm "R" is created, it creates a R-realm application with
a bunch of default roles (manage-users, manage-roles, etc.) into the
realm master.
We are currently thinking if we could mimic this structure for
applications. What do you think?
It's already messy with the way I modelled it and adding the same for applications
would be even worse. I don't see why that's needed though if we'd add what I
proposed.
> I had an idea a while back that is a simple way to achieve what you're
> asking for. Th> e idea would be to only allow an admin to grant roles that
> the admin has access to.
> Basically:> * A user with admin (super user) role can grant any roles (we
> would need to add a per-> realm super user role)
> * A user with the role manage-users and some roles on app1 can only grant
> other users > the roles on app1
> * A user with the role manage-users and some roles on app2 can only grant
> other users > the roles on app2
>
> This is something we should add in either case (to prevent users granting
themselves more access). Would it solve your problems?
12:33 p.m.
New subject: Application Management
OK, agreed. We thought this out of consistency, but if that's not a good
design we surely can consider a better one.
On Tue, Mar 24, 2015 at 9:44 AM, Stian Thorgersen <stian(a)redhat.com> wrote:
----- Original Message -----
> From: "Thiago Presa" <thiago.addevico(a)gmail.com>
> To: stian(a)redhat.com
> Cc: keycloak-user(a)lists.jboss.org
> Sent: Tuesday, 24 March, 2015 1:41:16 PM
> Subject: Re: [keycloak-user] Application Management
>
> Hi there,
>
> I'm Alex's coworker and I'll be working on this too.
>
> We were just discussing your idea, and it seems to fit our requirements.
>
> As far as we have seen, keycloak already has a realm-admin concept.
> Whenever a realm "R" is created, it creates a R-realm application with
> a bunch of default roles (manage-users, manage-roles, etc.) into the
> realm master.
>
> We are currently thinking if we could mimic this structure for
> applications. What do you think?
It's already messy with the way I modelled it and adding the same for
applications would be even worse. I don't see why that's needed though if
we'd add what I proposed.
>
> > I had an idea a while back that is a simple way to achieve what you're
> > asking for. Th> e idea would be to only allow an admin to grant roles
that
> > the admin has access to.
>
> > Basically:> * A user with admin (super user) role can grant any roles
(we
> > would need to add a per-> realm super user role)
>
> > * A user with the role manage-users and some roles on app1 can only
grant
> > other users > the roles on app1
>
> > * A user with the role manage-users and some roles on app2 can only
grant
> > other users > the roles on app2
>
> >
>
> > This is something we should add in either case (to prevent users
granting
> themselves more access). Would it solve your problems?
>
2:10 p.m.
New subject: Application Management
So I've spent the last couple of days playing with the source. :-)
The current authorization mechanism is based on Realm/RealmApp i.e.
whenever an API resource is called, check if the User has the required
Right (manage, any, view) in the resource's Realm/RealmApp.
Consider, for example, the URI
/admin/realms/{realm}/applications-by-id/{app-name}/roles/{role-name}. What
I was trying to do is to create a permission for {app-name} so that this
API call wouldn't require any Realm/RealmApp right.
The problem I see is that this API call trigger many methods (i.e.
AdminRoot#getRealmsAdmin, RealmsAdminResource#getRealmAdmin,
RealmAdminResource#getApplicationsById, and so on...), and at those methods
there is not enough information to figure out whether this is:
1- An app-specific call and thus should be authorized even without realm
authorization, or;
2- Not app-specific call and this should be properly authorized by
Realm/RealmApp.
Even in the case of (1), the information on which app should I check for
authorization is not available.
So it seems to me that this resource-loading mechanisms pressuposes an
authorization mechanism that checks only against the realm for permission,
and changing this seems daunting to me.
Do you guys have any idea on a more local change I could make to achieve
the intended behavior?
On Tue, Mar 24, 2015 at 2:33 PM, Thiago Presa <thiago.addevico(a)gmail.com>
wrote:
OK, agreed. We thought this out of consistency, but if that's not
a good
design we surely can consider a better one.
On Tue, Mar 24, 2015 at 9:44 AM, Stian Thorgersen <stian(a)redhat.com>
wrote:
>
>
> ----- Original Message -----
> > From: "Thiago Presa" <thiago.addevico(a)gmail.com>
> > To: stian(a)redhat.com
> > Cc: keycloak-user(a)lists.jboss.org
> > Sent: Tuesday, 24 March, 2015 1:41:16 PM
> > Subject: Re: [keycloak-user] Application Management
> >
> > Hi there,
> >
> > I'm Alex's coworker and I'll be working on this too.
> >
> > We were just discussing your idea, and it seems to fit our requirements.
> >
> > As far as we have seen, keycloak already has a realm-admin concept.
> > Whenever a realm "R" is created, it creates a R-realm application
with
> > a bunch of default roles (manage-users, manage-roles, etc.) into the
> > realm master.
> >
> > We are currently thinking if we could mimic this structure for
> > applications. What do you think?
>
> It's already messy with the way I modelled it and adding the same for
> applications would be even worse. I don't see why that's needed though if
> we'd add what I proposed.
>
> >
> > > I had an idea a while back that is a simple way to achieve what you're
> > > asking for. Th> e idea would be to only allow an admin to grant roles
> that
> > > the admin has access to.
> >
> > > Basically:> * A user with admin (super user) role can grant any roles
> (we
> > > would need to add a per-> realm super user role)
> >
> > > * A user with the role manage-users and some roles on app1 can only
> grant
> > > other users > the roles on app1
> >
> > > * A user with the role manage-users and some roles on app2 can only
> grant
> > > other users > the roles on app2
> >
> > >
> >
> > > This is something we should add in either case (to prevent users
> granting
> > themselves more access). Would it solve your problems?
> >
>
5:44 p.m.
New subject: Application Management
It would be nice if KeyCloak could share applications across realms in a
SaaS multi-tenant approach. Currently we need to use REST API to syncronize
app definitions.
On Thu, Mar 26, 2015 at 4:10 PM Thiago Presa <thiago.addevico(a)gmail.com>
wrote:
So I've spent the last couple of days playing with the source.
:-)
The current authorization mechanism is based on Realm/RealmApp i.e.
whenever an API resource is called, check if the User has the required
Right (manage, any, view) in the resource's Realm/RealmApp.
Consider, for example, the URI
/admin/realms/{realm}/applications-by-id/{app-name}/roles/{role-name}. What
I was trying to do is to create a permission for {app-name} so that this
API call wouldn't require any Realm/RealmApp right.
The problem I see is that this API call trigger many methods (i.e.
AdminRoot#getRealmsAdmin, RealmsAdminResource#getRealmAdmin,
RealmAdminResource#getApplicationsById, and so on...), and at those methods
there is not enough information to figure out whether this is:
1- An app-specific call and thus should be authorized even without realm
authorization, or;
2- Not app-specific call and this should be properly authorized by
Realm/RealmApp.
Even in the case of (1), the information on which app should I check for
authorization is not available.
So it seems to me that this resource-loading mechanisms pressuposes an
authorization mechanism that checks only against the realm for permission,
and changing this seems daunting to me.
Do you guys have any idea on a more local change I could make to achieve
the intended behavior?
On Tue, Mar 24, 2015 at 2:33 PM, Thiago Presa <thiago.addevico(a)gmail.com>
wrote:
> OK, agreed. We thought this out of consistency, but if that's not a good
> design we surely can consider a better one.
>
> On Tue, Mar 24, 2015 at 9:44 AM, Stian Thorgersen <stian(a)redhat.com>
> wrote:
>
>>
>>
>> ----- Original Message -----
>> > From: "Thiago Presa" <thiago.addevico(a)gmail.com>
>> > To: stian(a)redhat.com
>> > Cc: keycloak-user(a)lists.jboss.org
>> > Sent: Tuesday, 24 March, 2015 1:41:16 PM
>> > Subject: Re: [keycloak-user] Application Management
>> >
>> > Hi there,
>> >
>> > I'm Alex's coworker and I'll be working on this too.
>> >
>> > We were just discussing your idea, and it seems to fit our
>> requirements.
>> >
>> > As far as we have seen, keycloak already has a realm-admin concept.
>> > Whenever a realm "R" is created, it creates a R-realm application
with
>> > a bunch of default roles (manage-users, manage-roles, etc.) into the
>> > realm master.
>> >
>> > We are currently thinking if we could mimic this structure for
>> > applications. What do you think?
>>
>> It's already messy with the way I modelled it and adding the same for
>> applications would be even worse. I don't see why that's needed though
if
>> we'd add what I proposed.
>>
>> >
>> > > I had an idea a while back that is a simple way to achieve what
>> you're
>> > > asking for. Th> e idea would be to only allow an admin to grant
>> roles that
>> > > the admin has access to.
>> >
>> > > Basically:> * A user with admin (super user) role can grant any
>> roles (we
>> > > would need to add a per-> realm super user role)
>> >
>> > > * A user with the role manage-users and some roles on app1 can only
>> grant
>> > > other users > the roles on app1
>> >
>> > > * A user with the role manage-users and some roles on app2 can only
>> grant
>> > > other users > the roles on app2
>> >
>> > >
>> >
>> > > This is something we should add in either case (to prevent users
>> granting
>> > themselves more access). Would it solve your problems?
>> >
>>
>
>
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
11:58 p.m.
New subject: Application Management
Well, yes.. I told you it was a bit rubbish and would need some re-design to implement
more fine grained permissions. Doing that is a relatively big task and is not a high
priority for us ATM.
I'm a bit confused by this email as I proposed a simple solution that would resolve
your requirements. If an admin can only grant permissions that admin has access to all you
have to do is to create an admin that can only access roles for certain applications and
your problem should be solved. That's a simple solution that we can add soon.
----- Original Message -----
From: "Thiago Presa" <thiago.addevico(a)gmail.com>
To: "Stian Thorgersen" <stian(a)redhat.com>
Cc: keycloak-user(a)lists.jboss.org
Sent: Thursday, 26 March, 2015 8:10:07 PM
Subject: Re: [keycloak-user] Application Management
So I've spent the last couple of days playing with the source. :-)
The current authorization mechanism is based on Realm/RealmApp i.e.
whenever an API resource is called, check if the User has the required
Right (manage, any, view) in the resource's Realm/RealmApp.
Consider, for example, the URI
/admin/realms/{realm}/applications-by-id/{app-name}/roles/{role-name}. What
I was trying to do is to create a permission for {app-name} so that this
API call wouldn't require any Realm/RealmApp right.
The problem I see is that this API call trigger many methods (i.e.
AdminRoot#getRealmsAdmin, RealmsAdminResource#getRealmAdmin,
RealmAdminResource#getApplicationsById, and so on...), and at those methods
there is not enough information to figure out whether this is:
1- An app-specific call and thus should be authorized even without realm
authorization, or;
2- Not app-specific call and this should be properly authorized by
Realm/RealmApp.
Even in the case of (1), the information on which app should I check for
authorization is not available.
So it seems to me that this resource-loading mechanisms pressuposes an
authorization mechanism that checks only against the realm for permission,
and changing this seems daunting to me.
Do you guys have any idea on a more local change I could make to achieve
the intended behavior?
On Tue, Mar 24, 2015 at 2:33 PM, Thiago Presa <thiago.addevico(a)gmail.com>
wrote:
> OK, agreed. We thought this out of consistency, but if that's not a good
> design we surely can consider a better one.
>
> On Tue, Mar 24, 2015 at 9:44 AM, Stian Thorgersen <stian(a)redhat.com>
> wrote:
>
>>
>>
>> ----- Original Message -----
>> > From: "Thiago Presa" <thiago.addevico(a)gmail.com>
>> > To: stian(a)redhat.com
>> > Cc: keycloak-user(a)lists.jboss.org
>> > Sent: Tuesday, 24 March, 2015 1:41:16 PM
>> > Subject: Re: [keycloak-user] Application Management
>> >
>> > Hi there,
>> >
>> > I'm Alex's coworker and I'll be working on this too.
>> >
>> > We were just discussing your idea, and it seems to fit our requirements.
>> >
>> > As far as we have seen, keycloak already has a realm-admin concept.
>> > Whenever a realm "R" is created, it creates a R-realm application
with
>> > a bunch of default roles (manage-users, manage-roles, etc.) into the
>> > realm master.
>> >
>> > We are currently thinking if we could mimic this structure for
>> > applications. What do you think?
>>
>> It's already messy with the way I modelled it and adding the same for
>> applications would be even worse. I don't see why that's needed though
if
>> we'd add what I proposed.
>>
>> >
>> > > I had an idea a while back that is a simple way to achieve what
you're
>> > > asking for. Th> e idea would be to only allow an admin to grant
roles
>> that
>> > > the admin has access to.
>> >
>> > > Basically:> * A user with admin (super user) role can grant any
roles
>> (we
>> > > would need to add a per-> realm super user role)
>> >
>> > > * A user with the role manage-users and some roles on app1 can only
>> grant
>> > > other users > the roles on app1
>> >
>> > > * A user with the role manage-users and some roles on app2 can only
>> grant
>> > > other users > the roles on app2
>> >
>> > >
>> >
>> > > This is something we should add in either case (to prevent users
>> granting
>> > themselves more access). Would it solve your problems?
>> >
>>
>
>
8:01 a.m.
New subject: Application Management
Ah, yes, I didn't understand your proposal properly. Wouldn't giving
manage-users to app-admins wouldn't cause trouble, since app-admins could
create and modify user accounts?
On Fri, Mar 27, 2015 at 1:58 AM, Stian Thorgersen <stian(a)redhat.com> wrote:
Well, yes.. I told you it was a bit rubbish and would need some
re-design
to implement more fine grained permissions. Doing that is a relatively big
task and is not a high priority for us ATM.
I'm a bit confused by this email as I proposed a simple solution that
would resolve your requirements. If an admin can only grant permissions
that admin has access to all you have to do is to create an admin that can
only access roles for certain applications and your problem should be
solved. That's a simple solution that we can add soon.
----- Original Message -----
> From: "Thiago Presa" <thiago.addevico(a)gmail.com>
> To: "Stian Thorgersen" <stian(a)redhat.com>
> Cc: keycloak-user(a)lists.jboss.org
> Sent: Thursday, 26 March, 2015 8:10:07 PM
> Subject: Re: [keycloak-user] Application Management
>
> So I've spent the last couple of days playing with the source. :-)
>
> The current authorization mechanism is based on Realm/RealmApp i.e.
> whenever an API resource is called, check if the User has the required
> Right (manage, any, view) in the resource's Realm/RealmApp.
>
> Consider, for example, the URI
> /admin/realms/{realm}/applications-by-id/{app-name}/roles/{role-name}.
What
> I was trying to do is to create a permission for {app-name} so that this
> API call wouldn't require any Realm/RealmApp right.
>
> The problem I see is that this API call trigger many methods (i.e.
> AdminRoot#getRealmsAdmin, RealmsAdminResource#getRealmAdmin,
> RealmAdminResource#getApplicationsById, and so on...), and at those
methods
> there is not enough information to figure out whether this is:
>
> 1- An app-specific call and thus should be authorized even without realm
> authorization, or;
> 2- Not app-specific call and this should be properly authorized by
> Realm/RealmApp.
>
> Even in the case of (1), the information on which app should I check for
> authorization is not available.
>
> So it seems to me that this resource-loading mechanisms pressuposes an
> authorization mechanism that checks only against the realm for
permission,
> and changing this seems daunting to me.
>
> Do you guys have any idea on a more local change I could make to achieve
> the intended behavior?
>
> On Tue, Mar 24, 2015 at 2:33 PM, Thiago Presa <thiago.addevico(a)gmail.com
>
> wrote:
>
> > OK, agreed. We thought this out of consistency, but if that's not a
good
> > design we surely can consider a better one.
> >
> > On Tue, Mar 24, 2015 at 9:44 AM, Stian Thorgersen <stian(a)redhat.com>
> > wrote:
> >
> >>
> >>
> >> ----- Original Message -----
> >> > From: "Thiago Presa" <thiago.addevico(a)gmail.com>
> >> > To: stian(a)redhat.com
> >> > Cc: keycloak-user(a)lists.jboss.org
> >> > Sent: Tuesday, 24 March, 2015 1:41:16 PM
> >> > Subject: Re: [keycloak-user] Application Management
> >> >
> >> > Hi there,
> >> >
> >> > I'm Alex's coworker and I'll be working on this too.
> >> >
> >> > We were just discussing your idea, and it seems to fit our
requirements.
> >> >
> >> > As far as we have seen, keycloak already has a realm-admin concept.
> >> > Whenever a realm "R" is created, it creates a R-realm
application
with
> >> > a bunch of default roles (manage-users, manage-roles, etc.) into the
> >> > realm master.
> >> >
> >> > We are currently thinking if we could mimic this structure for
> >> > applications. What do you think?
> >>
> >> It's already messy with the way I modelled it and adding the same for
> >> applications would be even worse. I don't see why that's needed
though if
> >> we'd add what I proposed.
> >>
> >> >
> >> > > I had an idea a while back that is a simple way to achieve what
you're
> >> > > asking for. Th> e idea would be to only allow an admin to
grant
roles
> >> that
> >> > > the admin has access to.
> >> >
> >> > > Basically:> * A user with admin (super user) role can grant
any
roles
> >> (we
> >> > > would need to add a per-> realm super user role)
> >> >
> >> > > * A user with the role manage-users and some roles on app1 can
only
> >> grant
> >> > > other users > the roles on app1
> >> >
> >> > > * A user with the role manage-users and some roles on app2 can
only
> >> grant
> >> > > other users > the roles on app2
> >> >
> >> > >
> >> >
> >> > > This is something we should add in either case (to prevent users
> >> granting
> >> > themselves more access). Would it solve your problems?
> >> >
> >>
> >
> >
>
8:51 a.m.
New subject: Application Management
----- Original Message -----
From: "Thiago Presa" <thiago.addevico(a)gmail.com>
To: "Stian Thorgersen" <stian(a)redhat.com>
Cc: keycloak-user(a)lists.jboss.org
Sent: Friday, 27 March, 2015 2:01:56 PM
Subject: Re: [keycloak-user] Application Management
Ah, yes, I didn't understand your proposal properly. Wouldn't giving
manage-users to app-admins wouldn't cause trouble, since app-admins could
create and modify user accounts?
Whether or not it's causing trouble depends on your requirements, but yes, they could
create and modify user accounts, but not grant more privileges.
If you need to go beyond this one alternative is to wrap the admin endpoints in your own
application. We've just got so much on our plate at the moment that we can't
provide this level of control on permissions.
On Fri, Mar 27, 2015 at 1:58 AM, Stian Thorgersen <stian(a)redhat.com> wrote:
> Well, yes.. I told you it was a bit rubbish and would need some re-design
> to implement more fine grained permissions. Doing that is a relatively big
> task and is not a high priority for us ATM.
>
> I'm a bit confused by this email as I proposed a simple solution that
> would resolve your requirements. If an admin can only grant permissions
> that admin has access to all you have to do is to create an admin that can
> only access roles for certain applications and your problem should be
> solved. That's a simple solution that we can add soon.
>
> ----- Original Message -----
> > From: "Thiago Presa" <thiago.addevico(a)gmail.com>
> > To: "Stian Thorgersen" <stian(a)redhat.com>
> > Cc: keycloak-user(a)lists.jboss.org
> > Sent: Thursday, 26 March, 2015 8:10:07 PM
> > Subject: Re: [keycloak-user] Application Management
> >
> > So I've spent the last couple of days playing with the source. :-)
> >
> > The current authorization mechanism is based on Realm/RealmApp i.e.
> > whenever an API resource is called, check if the User has the required
> > Right (manage, any, view) in the resource's Realm/RealmApp.
> >
> > Consider, for example, the URI
> > /admin/realms/{realm}/applications-by-id/{app-name}/roles/{role-name}.
> What
> > I was trying to do is to create a permission for {app-name} so that this
> > API call wouldn't require any Realm/RealmApp right.
> >
> > The problem I see is that this API call trigger many methods (i.e.
> > AdminRoot#getRealmsAdmin, RealmsAdminResource#getRealmAdmin,
> > RealmAdminResource#getApplicationsById, and so on...), and at those
> methods
> > there is not enough information to figure out whether this is:
> >
> > 1- An app-specific call and thus should be authorized even without realm
> > authorization, or;
> > 2- Not app-specific call and this should be properly authorized by
> > Realm/RealmApp.
> >
> > Even in the case of (1), the information on which app should I check for
> > authorization is not available.
> >
> > So it seems to me that this resource-loading mechanisms pressuposes an
> > authorization mechanism that checks only against the realm for
> permission,
> > and changing this seems daunting to me.
> >
> > Do you guys have any idea on a more local change I could make to achieve
> > the intended behavior?
> >
> > On Tue, Mar 24, 2015 at 2:33 PM, Thiago Presa <thiago.addevico(a)gmail.com
> >
> > wrote:
> >
> > > OK, agreed. We thought this out of consistency, but if that's not a
> good
> > > design we surely can consider a better one.
> > >
> > > On Tue, Mar 24, 2015 at 9:44 AM, Stian Thorgersen
<stian(a)redhat.com>
> > > wrote:
> > >
> > >>
> > >>
> > >> ----- Original Message -----
> > >> > From: "Thiago Presa" <thiago.addevico(a)gmail.com>
> > >> > To: stian(a)redhat.com
> > >> > Cc: keycloak-user(a)lists.jboss.org
> > >> > Sent: Tuesday, 24 March, 2015 1:41:16 PM
> > >> > Subject: Re: [keycloak-user] Application Management
> > >> >
> > >> > Hi there,
> > >> >
> > >> > I'm Alex's coworker and I'll be working on this too.
> > >> >
> > >> > We were just discussing your idea, and it seems to fit our
> requirements.
> > >> >
> > >> > As far as we have seen, keycloak already has a realm-admin
concept.
> > >> > Whenever a realm "R" is created, it creates a R-realm
application
> with
> > >> > a bunch of default roles (manage-users, manage-roles, etc.) into
the
> > >> > realm master.
> > >> >
> > >> > We are currently thinking if we could mimic this structure for
> > >> > applications. What do you think?
> > >>
> > >> It's already messy with the way I modelled it and adding the same
for
> > >> applications would be even worse. I don't see why that's
needed
> though if
> > >> we'd add what I proposed.
> > >>
> > >> >
> > >> > > I had an idea a while back that is a simple way to achieve
what
> you're
> > >> > > asking for. Th> e idea would be to only allow an admin to
grant
> roles
> > >> that
> > >> > > the admin has access to.
> > >> >
> > >> > > Basically:> * A user with admin (super user) role can
grant any
> roles
> > >> (we
> > >> > > would need to add a per-> realm super user role)
> > >> >
> > >> > > * A user with the role manage-users and some roles on app1
can
> only
> > >> grant
> > >> > > other users > the roles on app1
> > >> >
> > >> > > * A user with the role manage-users and some roles on app2
can
> only
> > >> grant
> > >> > > other users > the roles on app2
> > >> >
> > >> > >
> > >> >
> > >> > > This is something we should add in either case (to prevent
users
> > >> granting
> > >> > themselves more access). Would it solve your problems?
> > >> >
> > >>
> > >
> > >
> >
>
12:33 p.m.
New subject: Application Management
Speaking with my colleagues, I believe it won't cause troubles for us. We
had to give view-applications: the admin console wouldn't work properly,
but this is also OK according to our requirements.
Would you mind giving us some feedback on [1]? We wrote this to experiment
a bit with the proposal, but I'm not familiar with keycloak's source or
practices. What should I do to help get this merged?
[1] https://github.com/keycloak/keycloak/compare/master...tpresa:master
On Fri, Mar 27, 2015 at 10:51 AM, Stian Thorgersen <stian(a)redhat.com> wrote:
----- Original Message -----
> From: "Thiago Presa" <thiago.addevico(a)gmail.com>
> To: "Stian Thorgersen" <stian(a)redhat.com>
> Cc: keycloak-user(a)lists.jboss.org
> Sent: Friday, 27 March, 2015 2:01:56 PM
> Subject: Re: [keycloak-user] Application Management
>
> Ah, yes, I didn't understand your proposal properly. Wouldn't giving
> manage-users to app-admins wouldn't cause trouble, since app-admins could
> create and modify user accounts?
Whether or not it's causing trouble depends on your requirements, but yes,
they could create and modify user accounts, but not grant more privileges.
If you need to go beyond this one alternative is to wrap the admin
endpoints in your own application. We've just got so much on our plate at
the moment that we can't provide this level of control on permissions.
>
> On Fri, Mar 27, 2015 at 1:58 AM, Stian Thorgersen <stian(a)redhat.com>
wrote:
>
> > Well, yes.. I told you it was a bit rubbish and would need some
re-design
> > to implement more fine grained permissions. Doing that is a relatively
big
> > task and is not a high priority for us ATM.
> >
> > I'm a bit confused by this email as I proposed a simple solution that
> > would resolve your requirements. If an admin can only grant permissions
> > that admin has access to all you have to do is to create an admin that
can
> > only access roles for certain applications and your problem should be
> > solved. That's a simple solution that we can add soon.
> >
> > ----- Original Message -----
> > > From: "Thiago Presa" <thiago.addevico(a)gmail.com>
> > > To: "Stian Thorgersen" <stian(a)redhat.com>
> > > Cc: keycloak-user(a)lists.jboss.org
> > > Sent: Thursday, 26 March, 2015 8:10:07 PM
> > > Subject: Re: [keycloak-user] Application Management
> > >
> > > So I've spent the last couple of days playing with the source. :-)
> > >
> > > The current authorization mechanism is based on Realm/RealmApp i.e.
> > > whenever an API resource is called, check if the User has the
required
> > > Right (manage, any, view) in the resource's Realm/RealmApp.
> > >
> > > Consider, for example, the URI
> > >
/admin/realms/{realm}/applications-by-id/{app-name}/roles/{role-name}.
> > What
> > > I was trying to do is to create a permission for {app-name} so that
this
> > > API call wouldn't require any Realm/RealmApp right.
> > >
> > > The problem I see is that this API call trigger many methods (i.e.
> > > AdminRoot#getRealmsAdmin, RealmsAdminResource#getRealmAdmin,
> > > RealmAdminResource#getApplicationsById, and so on...), and at those
> > methods
> > > there is not enough information to figure out whether this is:
> > >
> > > 1- An app-specific call and thus should be authorized even without
realm
> > > authorization, or;
> > > 2- Not app-specific call and this should be properly authorized by
> > > Realm/RealmApp.
> > >
> > > Even in the case of (1), the information on which app should I check
for
> > > authorization is not available.
> > >
> > > So it seems to me that this resource-loading mechanisms pressuposes
an
> > > authorization mechanism that checks only against the realm for
> > permission,
> > > and changing this seems daunting to me.
> > >
> > > Do you guys have any idea on a more local change I could make to
achieve
> > > the intended behavior?
> > >
> > > On Tue, Mar 24, 2015 at 2:33 PM, Thiago Presa <
thiago.addevico(a)gmail.com
> > >
> > > wrote:
> > >
> > > > OK, agreed. We thought this out of consistency, but if that's not
a
> > good
> > > > design we surely can consider a better one.
> > > >
> > > > On Tue, Mar 24, 2015 at 9:44 AM, Stian Thorgersen <
stian(a)redhat.com>
> > > > wrote:
> > > >
> > > >>
> > > >>
> > > >> ----- Original Message -----
> > > >> > From: "Thiago Presa"
<thiago.addevico(a)gmail.com>
> > > >> > To: stian(a)redhat.com
> > > >> > Cc: keycloak-user(a)lists.jboss.org
> > > >> > Sent: Tuesday, 24 March, 2015 1:41:16 PM
> > > >> > Subject: Re: [keycloak-user] Application Management
> > > >> >
> > > >> > Hi there,
> > > >> >
> > > >> > I'm Alex's coworker and I'll be working on this
too.
> > > >> >
> > > >> > We were just discussing your idea, and it seems to fit our
> > requirements.
> > > >> >
> > > >> > As far as we have seen, keycloak already has a realm-admin
concept.
> > > >> > Whenever a realm "R" is created, it creates a
R-realm
application
> > with
> > > >> > a bunch of default roles (manage-users, manage-roles, etc.)
into the
> > > >> > realm master.
> > > >> >
> > > >> > We are currently thinking if we could mimic this structure
for
> > > >> > applications. What do you think?
> > > >>
> > > >> It's already messy with the way I modelled it and adding the
same
for
> > > >> applications would be even worse. I don't see why that's
needed
> > though if
> > > >> we'd add what I proposed.
> > > >>
> > > >> >
> > > >> > > I had an idea a while back that is a simple way to
achieve
what
> > you're
> > > >> > > asking for. Th> e idea would be to only allow an
admin to
grant
> > roles
> > > >> that
> > > >> > > the admin has access to.
> > > >> >
> > > >> > > Basically:> * A user with admin (super user) role
can grant
any
> > roles
> > > >> (we
> > > >> > > would need to add a per-> realm super user role)
> > > >> >
> > > >> > > * A user with the role manage-users and some roles on
app1 can
> > only
> > > >> grant
> > > >> > > other users > the roles on app1
> > > >> >
> > > >> > > * A user with the role manage-users and some roles on
app2 can
> > only
> > > >> grant
> > > >> > > other users > the roles on app2
> > > >> >
> > > >> > >
> > > >> >
> > > >> > > This is something we should add in either case (to
prevent
users
> > > >> granting
> > > >> > themselves more access). Would it solve your problems?
> > > >> >
> > > >>
> > > >
> > > >
> > >
> >
>
1:38 a.m.
New subject: Application Management
What's the purpose of app-admin?
----- Original Message -----
From: "Thiago Presa" <thiago.addevico(a)gmail.com>
To: "Stian Thorgersen" <stian(a)redhat.com>
Cc: keycloak-user(a)lists.jboss.org
Sent: Wednesday, 1 April, 2015 7:33:26 PM
Subject: Re: [keycloak-user] Application Management
Speaking with my colleagues, I believe it won't cause troubles for us. We
had to give view-applications: the admin console wouldn't work properly,
but this is also OK according to our requirements.
Would you mind giving us some feedback on [1]? We wrote this to experiment
a bit with the proposal, but I'm not familiar with keycloak's source or
practices. What should I do to help get this merged?
[1] https://github.com/keycloak/keycloak/compare/master...tpresa:master
On Fri, Mar 27, 2015 at 10:51 AM, Stian Thorgersen <stian(a)redhat.com> wrote:
>
>
> ----- Original Message -----
> > From: "Thiago Presa" <thiago.addevico(a)gmail.com>
> > To: "Stian Thorgersen" <stian(a)redhat.com>
> > Cc: keycloak-user(a)lists.jboss.org
> > Sent: Friday, 27 March, 2015 2:01:56 PM
> > Subject: Re: [keycloak-user] Application Management
> >
> > Ah, yes, I didn't understand your proposal properly. Wouldn't giving
> > manage-users to app-admins wouldn't cause trouble, since app-admins could
> > create and modify user accounts?
>
> Whether or not it's causing trouble depends on your requirements, but yes,
> they could create and modify user accounts, but not grant more privileges.
>
> If you need to go beyond this one alternative is to wrap the admin
> endpoints in your own application. We've just got so much on our plate at
> the moment that we can't provide this level of control on permissions.
>
> >
> > On Fri, Mar 27, 2015 at 1:58 AM, Stian Thorgersen <stian(a)redhat.com>
> wrote:
> >
> > > Well, yes.. I told you it was a bit rubbish and would need some
> re-design
> > > to implement more fine grained permissions. Doing that is a relatively
> big
> > > task and is not a high priority for us ATM.
> > >
> > > I'm a bit confused by this email as I proposed a simple solution that
> > > would resolve your requirements. If an admin can only grant permissions
> > > that admin has access to all you have to do is to create an admin that
> can
> > > only access roles for certain applications and your problem should be
> > > solved. That's a simple solution that we can add soon.
> > >
> > > ----- Original Message -----
> > > > From: "Thiago Presa" <thiago.addevico(a)gmail.com>
> > > > To: "Stian Thorgersen" <stian(a)redhat.com>
> > > > Cc: keycloak-user(a)lists.jboss.org
> > > > Sent: Thursday, 26 March, 2015 8:10:07 PM
> > > > Subject: Re: [keycloak-user] Application Management
> > > >
> > > > So I've spent the last couple of days playing with the source.
:-)
> > > >
> > > > The current authorization mechanism is based on Realm/RealmApp i.e.
> > > > whenever an API resource is called, check if the User has the
> required
> > > > Right (manage, any, view) in the resource's Realm/RealmApp.
> > > >
> > > > Consider, for example, the URI
> > > >
> /admin/realms/{realm}/applications-by-id/{app-name}/roles/{role-name}.
> > > What
> > > > I was trying to do is to create a permission for {app-name} so that
> this
> > > > API call wouldn't require any Realm/RealmApp right.
> > > >
> > > > The problem I see is that this API call trigger many methods (i.e.
> > > > AdminRoot#getRealmsAdmin, RealmsAdminResource#getRealmAdmin,
> > > > RealmAdminResource#getApplicationsById, and so on...), and at those
> > > methods
> > > > there is not enough information to figure out whether this is:
> > > >
> > > > 1- An app-specific call and thus should be authorized even without
> realm
> > > > authorization, or;
> > > > 2- Not app-specific call and this should be properly authorized by
> > > > Realm/RealmApp.
> > > >
> > > > Even in the case of (1), the information on which app should I check
> for
> > > > authorization is not available.
> > > >
> > > > So it seems to me that this resource-loading mechanisms pressuposes
> an
> > > > authorization mechanism that checks only against the realm for
> > > permission,
> > > > and changing this seems daunting to me.
> > > >
> > > > Do you guys have any idea on a more local change I could make to
> achieve
> > > > the intended behavior?
> > > >
> > > > On Tue, Mar 24, 2015 at 2:33 PM, Thiago Presa <
> thiago.addevico(a)gmail.com
> > > >
> > > > wrote:
> > > >
> > > > > OK, agreed. We thought this out of consistency, but if
that's not a
> > > good
> > > > > design we surely can consider a better one.
> > > > >
> > > > > On Tue, Mar 24, 2015 at 9:44 AM, Stian Thorgersen <
> stian(a)redhat.com>
> > > > > wrote:
> > > > >
> > > > >>
> > > > >>
> > > > >> ----- Original Message -----
> > > > >> > From: "Thiago Presa"
<thiago.addevico(a)gmail.com>
> > > > >> > To: stian(a)redhat.com
> > > > >> > Cc: keycloak-user(a)lists.jboss.org
> > > > >> > Sent: Tuesday, 24 March, 2015 1:41:16 PM
> > > > >> > Subject: Re: [keycloak-user] Application Management
> > > > >> >
> > > > >> > Hi there,
> > > > >> >
> > > > >> > I'm Alex's coworker and I'll be working on
this too.
> > > > >> >
> > > > >> > We were just discussing your idea, and it seems to fit
our
> > > requirements.
> > > > >> >
> > > > >> > As far as we have seen, keycloak already has a
realm-admin
> concept.
> > > > >> > Whenever a realm "R" is created, it creates a
R-realm
> application
> > > with
> > > > >> > a bunch of default roles (manage-users, manage-roles,
etc.)
> into the
> > > > >> > realm master.
> > > > >> >
> > > > >> > We are currently thinking if we could mimic this
structure for
> > > > >> > applications. What do you think?
> > > > >>
> > > > >> It's already messy with the way I modelled it and adding
the same
> for
> > > > >> applications would be even worse. I don't see why
that's needed
> > > though if
> > > > >> we'd add what I proposed.
> > > > >>
> > > > >> >
> > > > >> > > I had an idea a while back that is a simple way to
achieve
> what
> > > you're
> > > > >> > > asking for. Th> e idea would be to only allow
an admin to
> grant
> > > roles
> > > > >> that
> > > > >> > > the admin has access to.
> > > > >> >
> > > > >> > > Basically:> * A user with admin (super user)
role can grant
> any
> > > roles
> > > > >> (we
> > > > >> > > would need to add a per-> realm super user
role)
> > > > >> >
> > > > >> > > * A user with the role manage-users and some roles
on app1 can
> > > only
> > > > >> grant
> > > > >> > > other users > the roles on app1
> > > > >> >
> > > > >> > > * A user with the role manage-users and some roles
on app2 can
> > > only
> > > > >> grant
> > > > >> > > other users > the roles on app2
> > > > >> >
> > > > >> > >
> > > > >> >
> > > > >> > > This is something we should add in either case (to
prevent
> users
> > > > >> granting
> > > > >> > themselves more access). Would it solve your problems?
> > > > >> >
> > > > >>
> > > > >
> > > > >
> > > >
> > >
> >
>
8:24 a.m.
New subject: Application Management
To make sure that the user has all roles of a given application. If someone
creates another role after granting app-admin, it is automatically inserted
into app-admin composite role and therefore granted.
On Tue, Apr 7, 2015 at 3:38 AM, Stian Thorgersen <stian(a)redhat.com> wrote:
What's the purpose of app-admin?
----- Original Message -----
> From: "Thiago Presa" <thiago.addevico(a)gmail.com>
> To: "Stian Thorgersen" <stian(a)redhat.com>
> Cc: keycloak-user(a)lists.jboss.org
> Sent: Wednesday, 1 April, 2015 7:33:26 PM
> Subject: Re: [keycloak-user] Application Management
>
> Speaking with my colleagues, I believe it won't cause troubles for us. We
> had to give view-applications: the admin console wouldn't work properly,
> but this is also OK according to our requirements.
>
> Would you mind giving us some feedback on [1]? We wrote this to
experiment
> a bit with the proposal, but I'm not familiar with keycloak's source or
> practices. What should I do to help get this merged?
>
> [1] https://github.com/keycloak/keycloak/compare/master...tpresa:master
>
> On Fri, Mar 27, 2015 at 10:51 AM, Stian Thorgersen <stian(a)redhat.com>
wrote:
>
> >
> >
> > ----- Original Message -----
> > > From: "Thiago Presa" <thiago.addevico(a)gmail.com>
> > > To: "Stian Thorgersen" <stian(a)redhat.com>
> > > Cc: keycloak-user(a)lists.jboss.org
> > > Sent: Friday, 27 March, 2015 2:01:56 PM
> > > Subject: Re: [keycloak-user] Application Management
> > >
> > > Ah, yes, I didn't understand your proposal properly. Wouldn't
giving
> > > manage-users to app-admins wouldn't cause trouble, since app-admins
could
> > > create and modify user accounts?
> >
> > Whether or not it's causing trouble depends on your requirements, but
yes,
> > they could create and modify user accounts, but not grant more
privileges.
> >
> > If you need to go beyond this one alternative is to wrap the admin
> > endpoints in your own application. We've just got so much on our plate
at
> > the moment that we can't provide this level of control on permissions.
> >
> > >
> > > On Fri, Mar 27, 2015 at 1:58 AM, Stian Thorgersen
<stian(a)redhat.com>
> > wrote:
> > >
> > > > Well, yes.. I told you it was a bit rubbish and would need some
> > re-design
> > > > to implement more fine grained permissions. Doing that is a
relatively
> > big
> > > > task and is not a high priority for us ATM.
> > > >
> > > > I'm a bit confused by this email as I proposed a simple solution
that
> > > > would resolve your requirements. If an admin can only grant
permissions
> > > > that admin has access to all you have to do is to create an admin
that
> > can
> > > > only access roles for certain applications and your problem should
be
> > > > solved. That's a simple solution that we can add soon.
> > > >
> > > > ----- Original Message -----
> > > > > From: "Thiago Presa"
<thiago.addevico(a)gmail.com>
> > > > > To: "Stian Thorgersen" <stian(a)redhat.com>
> > > > > Cc: keycloak-user(a)lists.jboss.org
> > > > > Sent: Thursday, 26 March, 2015 8:10:07 PM
> > > > > Subject: Re: [keycloak-user] Application Management
> > > > >
> > > > > So I've spent the last couple of days playing with the
source.
:-)
> > > > >
> > > > > The current authorization mechanism is based on Realm/RealmApp
i.e.
> > > > > whenever an API resource is called, check if the User has the
> > required
> > > > > Right (manage, any, view) in the resource's Realm/RealmApp.
> > > > >
> > > > > Consider, for example, the URI
> > > > >
> > /admin/realms/{realm}/applications-by-id/{app-name}/roles/{role-name}.
> > > > What
> > > > > I was trying to do is to create a permission for {app-name} so
that
> > this
> > > > > API call wouldn't require any Realm/RealmApp right.
> > > > >
> > > > > The problem I see is that this API call trigger many methods
(i.e.
> > > > > AdminRoot#getRealmsAdmin, RealmsAdminResource#getRealmAdmin,
> > > > > RealmAdminResource#getApplicationsById, and so on...), and at
those
> > > > methods
> > > > > there is not enough information to figure out whether this is:
> > > > >
> > > > > 1- An app-specific call and thus should be authorized even
without
> > realm
> > > > > authorization, or;
> > > > > 2- Not app-specific call and this should be properly authorized
by
> > > > > Realm/RealmApp.
> > > > >
> > > > > Even in the case of (1), the information on which app should I
check
> > for
> > > > > authorization is not available.
> > > > >
> > > > > So it seems to me that this resource-loading mechanisms
pressuposes
> > an
> > > > > authorization mechanism that checks only against the realm for
> > > > permission,
> > > > > and changing this seems daunting to me.
> > > > >
> > > > > Do you guys have any idea on a more local change I could make
to
> > achieve
> > > > > the intended behavior?
> > > > >
> > > > > On Tue, Mar 24, 2015 at 2:33 PM, Thiago Presa <
> > thiago.addevico(a)gmail.com
> > > > >
> > > > > wrote:
> > > > >
> > > > > > OK, agreed. We thought this out of consistency, but if
that's
not a
> > > > good
> > > > > > design we surely can consider a better one.
> > > > > >
> > > > > > On Tue, Mar 24, 2015 at 9:44 AM, Stian Thorgersen <
> > stian(a)redhat.com>
> > > > > > wrote:
> > > > > >
> > > > > >>
> > > > > >>
> > > > > >> ----- Original Message -----
> > > > > >> > From: "Thiago Presa"
<thiago.addevico(a)gmail.com>
> > > > > >> > To: stian(a)redhat.com
> > > > > >> > Cc: keycloak-user(a)lists.jboss.org
> > > > > >> > Sent: Tuesday, 24 March, 2015 1:41:16 PM
> > > > > >> > Subject: Re: [keycloak-user] Application
Management
> > > > > >> >
> > > > > >> > Hi there,
> > > > > >> >
> > > > > >> > I'm Alex's coworker and I'll be
working on this too.
> > > > > >> >
> > > > > >> > We were just discussing your idea, and it seems to
fit our
> > > > requirements.
> > > > > >> >
> > > > > >> > As far as we have seen, keycloak already has a
realm-admin
> > concept.
> > > > > >> > Whenever a realm "R" is created, it
creates a R-realm
> > application
> > > > with
> > > > > >> > a bunch of default roles (manage-users,
manage-roles, etc.)
> > into the
> > > > > >> > realm master.
> > > > > >> >
> > > > > >> > We are currently thinking if we could mimic this
structure
for
> > > > > >> > applications. What do you think?
> > > > > >>
> > > > > >> It's already messy with the way I modelled it and
adding the
same
> > for
> > > > > >> applications would be even worse. I don't see why
that's
needed
> > > > though if
> > > > > >> we'd add what I proposed.
> > > > > >>
> > > > > >> >
> > > > > >> > > I had an idea a while back that is a simple
way to achieve
> > what
> > > > you're
> > > > > >> > > asking for. Th> e idea would be to only
allow an admin to
> > grant
> > > > roles
> > > > > >> that
> > > > > >> > > the admin has access to.
> > > > > >> >
> > > > > >> > > Basically:> * A user with admin (super
user) role can
grant
> > any
> > > > roles
> > > > > >> (we
> > > > > >> > > would need to add a per-> realm super user
role)
> > > > > >> >
> > > > > >> > > * A user with the role manage-users and some
roles on
app1 can
> > > > only
> > > > > >> grant
> > > > > >> > > other users > the roles on app1
> > > > > >> >
> > > > > >> > > * A user with the role manage-users and some
roles on
app2 can
> > > > only
> > > > > >> grant
> > > > > >> > > other users > the roles on app2
> > > > > >> >
> > > > > >> > >
> > > > > >> >
> > > > > >> > > This is something we should add in either
case (to prevent
> > users
> > > > > >> granting
> > > > > >> > themselves more access). Would it solve your
problems?
> > > > > >> >
> > > > > >>
> > > > > >
> > > > > >
> > > > >
> > > >
> > >
> >
>
11:15 p.m.
New subject: Application Management
Keycloak doesn't add any roles to applications, as we don't want to make
special/reserved roles on those and leave it up to users to decide what roles they want.
So that would have to be removed.
----- Original Message -----
From: "Thiago Presa" <thiago.addevico(a)gmail.com>
To: "Stian Thorgersen" <stian(a)redhat.com>
Cc: keycloak-user(a)lists.jboss.org
Sent: Tuesday, 7 April, 2015 3:24:59 PM
Subject: Re: [keycloak-user] Application Management
To make sure that the user has all roles of a given application. If someone
creates another role after granting app-admin, it is automatically inserted
into app-admin composite role and therefore granted.
On Tue, Apr 7, 2015 at 3:38 AM, Stian Thorgersen <stian(a)redhat.com> wrote:
> What's the purpose of app-admin?
>
> ----- Original Message -----
> > From: "Thiago Presa" <thiago.addevico(a)gmail.com>
> > To: "Stian Thorgersen" <stian(a)redhat.com>
> > Cc: keycloak-user(a)lists.jboss.org
> > Sent: Wednesday, 1 April, 2015 7:33:26 PM
> > Subject: Re: [keycloak-user] Application Management
> >
> > Speaking with my colleagues, I believe it won't cause troubles for us. We
> > had to give view-applications: the admin console wouldn't work properly,
> > but this is also OK according to our requirements.
> >
> > Would you mind giving us some feedback on [1]? We wrote this to
> experiment
> > a bit with the proposal, but I'm not familiar with keycloak's source
or
> > practices. What should I do to help get this merged?
> >
> > [1] https://github.com/keycloak/keycloak/compare/master...tpresa:master
> >
> > On Fri, Mar 27, 2015 at 10:51 AM, Stian Thorgersen <stian(a)redhat.com>
> wrote:
> >
> > >
> > >
> > > ----- Original Message -----
> > > > From: "Thiago Presa" <thiago.addevico(a)gmail.com>
> > > > To: "Stian Thorgersen" <stian(a)redhat.com>
> > > > Cc: keycloak-user(a)lists.jboss.org
> > > > Sent: Friday, 27 March, 2015 2:01:56 PM
> > > > Subject: Re: [keycloak-user] Application Management
> > > >
> > > > Ah, yes, I didn't understand your proposal properly. Wouldn't
giving
> > > > manage-users to app-admins wouldn't cause trouble, since
app-admins
> could
> > > > create and modify user accounts?
> > >
> > > Whether or not it's causing trouble depends on your requirements, but
> yes,
> > > they could create and modify user accounts, but not grant more
> privileges.
> > >
> > > If you need to go beyond this one alternative is to wrap the admin
> > > endpoints in your own application. We've just got so much on our
plate
> at
> > > the moment that we can't provide this level of control on
permissions.
> > >
> > > >
> > > > On Fri, Mar 27, 2015 at 1:58 AM, Stian Thorgersen
<stian(a)redhat.com>
> > > wrote:
> > > >
> > > > > Well, yes.. I told you it was a bit rubbish and would need some
> > > re-design
> > > > > to implement more fine grained permissions. Doing that is a
> relatively
> > > big
> > > > > task and is not a high priority for us ATM.
> > > > >
> > > > > I'm a bit confused by this email as I proposed a simple
solution
> that
> > > > > would resolve your requirements. If an admin can only grant
> permissions
> > > > > that admin has access to all you have to do is to create an
admin
> that
> > > can
> > > > > only access roles for certain applications and your problem
should
> be
> > > > > solved. That's a simple solution that we can add soon.
> > > > >
> > > > > ----- Original Message -----
> > > > > > From: "Thiago Presa"
<thiago.addevico(a)gmail.com>
> > > > > > To: "Stian Thorgersen" <stian(a)redhat.com>
> > > > > > Cc: keycloak-user(a)lists.jboss.org
> > > > > > Sent: Thursday, 26 March, 2015 8:10:07 PM
> > > > > > Subject: Re: [keycloak-user] Application Management
> > > > > >
> > > > > > So I've spent the last couple of days playing with the
source.
> :-)
> > > > > >
> > > > > > The current authorization mechanism is based on
Realm/RealmApp
> i.e.
> > > > > > whenever an API resource is called, check if the User has
the
> > > required
> > > > > > Right (manage, any, view) in the resource's
Realm/RealmApp.
> > > > > >
> > > > > > Consider, for example, the URI
> > > > > >
> > > /admin/realms/{realm}/applications-by-id/{app-name}/roles/{role-name}.
> > > > > What
> > > > > > I was trying to do is to create a permission for {app-name}
so
> that
> > > this
> > > > > > API call wouldn't require any Realm/RealmApp right.
> > > > > >
> > > > > > The problem I see is that this API call trigger many
methods
> (i.e.
> > > > > > AdminRoot#getRealmsAdmin,
RealmsAdminResource#getRealmAdmin,
> > > > > > RealmAdminResource#getApplicationsById, and so on...), and
at
> those
> > > > > methods
> > > > > > there is not enough information to figure out whether this
is:
> > > > > >
> > > > > > 1- An app-specific call and thus should be authorized even
> without
> > > realm
> > > > > > authorization, or;
> > > > > > 2- Not app-specific call and this should be properly
authorized
> by
> > > > > > Realm/RealmApp.
> > > > > >
> > > > > > Even in the case of (1), the information on which app
should I
> check
> > > for
> > > > > > authorization is not available.
> > > > > >
> > > > > > So it seems to me that this resource-loading mechanisms
> pressuposes
> > > an
> > > > > > authorization mechanism that checks only against the realm
for
> > > > > permission,
> > > > > > and changing this seems daunting to me.
> > > > > >
> > > > > > Do you guys have any idea on a more local change I could
make to
> > > achieve
> > > > > > the intended behavior?
> > > > > >
> > > > > > On Tue, Mar 24, 2015 at 2:33 PM, Thiago Presa <
> > > thiago.addevico(a)gmail.com
> > > > > >
> > > > > > wrote:
> > > > > >
> > > > > > > OK, agreed. We thought this out of consistency, but if
that's
> not a
> > > > > good
> > > > > > > design we surely can consider a better one.
> > > > > > >
> > > > > > > On Tue, Mar 24, 2015 at 9:44 AM, Stian Thorgersen
<
> > > stian(a)redhat.com>
> > > > > > > wrote:
> > > > > > >
> > > > > > >>
> > > > > > >>
> > > > > > >> ----- Original Message -----
> > > > > > >> > From: "Thiago Presa"
<thiago.addevico(a)gmail.com>
> > > > > > >> > To: stian(a)redhat.com
> > > > > > >> > Cc: keycloak-user(a)lists.jboss.org
> > > > > > >> > Sent: Tuesday, 24 March, 2015 1:41:16 PM
> > > > > > >> > Subject: Re: [keycloak-user] Application
Management
> > > > > > >> >
> > > > > > >> > Hi there,
> > > > > > >> >
> > > > > > >> > I'm Alex's coworker and I'll be
working on this too.
> > > > > > >> >
> > > > > > >> > We were just discussing your idea, and it
seems to fit our
> > > > > requirements.
> > > > > > >> >
> > > > > > >> > As far as we have seen, keycloak already has
a realm-admin
> > > concept.
> > > > > > >> > Whenever a realm "R" is created, it
creates a R-realm
> > > application
> > > > > with
> > > > > > >> > a bunch of default roles (manage-users,
manage-roles, etc.)
> > > into the
> > > > > > >> > realm master.
> > > > > > >> >
> > > > > > >> > We are currently thinking if we could mimic
this structure
> for
> > > > > > >> > applications. What do you think?
> > > > > > >>
> > > > > > >> It's already messy with the way I modelled it
and adding the
> same
> > > for
> > > > > > >> applications would be even worse. I don't see
why that's
> needed
> > > > > though if
> > > > > > >> we'd add what I proposed.
> > > > > > >>
> > > > > > >> >
> > > > > > >> > > I had an idea a while back that is a
simple way to achieve
> > > what
> > > > > you're
> > > > > > >> > > asking for. Th> e idea would be to
only allow an admin to
> > > grant
> > > > > roles
> > > > > > >> that
> > > > > > >> > > the admin has access to.
> > > > > > >> >
> > > > > > >> > > Basically:> * A user with admin
(super user) role can
> grant
> > > any
> > > > > roles
> > > > > > >> (we
> > > > > > >> > > would need to add a per-> realm super
user role)
> > > > > > >> >
> > > > > > >> > > * A user with the role manage-users and
some roles on
> app1 can
> > > > > only
> > > > > > >> grant
> > > > > > >> > > other users > the roles on app1
> > > > > > >> >
> > > > > > >> > > * A user with the role manage-users and
some roles on
> app2 can
> > > > > only
> > > > > > >> grant
> > > > > > >> > > other users > the roles on app2
> > > > > > >> >
> > > > > > >> > >
> > > > > > >> >
> > > > > > >> > > This is something we should add in
either case (to prevent
> > > users
> > > > > > >> granting
> > > > > > >> > themselves more access). Would it solve your
problems?
> > > > > > >> >
> > > > > > >>
> > > > > > >
> > > > > > >
> > > > > >
> > > > >
> > > >
> > >
> >
>
1:11 p.m.
New subject: Application Management
Sorry for the delay, I removed it.
On Wed, Apr 8, 2015 at 1:15 AM, Stian Thorgersen <stian(a)redhat.com> wrote:
Keycloak doesn't add any roles to applications, as we don't
want to make
special/reserved roles on those and leave it up to users to decide what
roles they want. So that would have to be removed.
----- Original Message -----
> From: "Thiago Presa" <thiago.addevico(a)gmail.com>
> To: "Stian Thorgersen" <stian(a)redhat.com>
> Cc: keycloak-user(a)lists.jboss.org
> Sent: Tuesday, 7 April, 2015 3:24:59 PM
> Subject: Re: [keycloak-user] Application Management
>
> To make sure that the user has all roles of a given application. If
someone
> creates another role after granting app-admin, it is automatically
inserted
> into app-admin composite role and therefore granted.
>
> On Tue, Apr 7, 2015 at 3:38 AM, Stian Thorgersen <stian(a)redhat.com>
wrote:
>
> > What's the purpose of app-admin?
> >
> > ----- Original Message -----
> > > From: "Thiago Presa" <thiago.addevico(a)gmail.com>
> > > To: "Stian Thorgersen" <stian(a)redhat.com>
> > > Cc: keycloak-user(a)lists.jboss.org
> > > Sent: Wednesday, 1 April, 2015 7:33:26 PM
> > > Subject: Re: [keycloak-user] Application Management
> > >
> > > Speaking with my colleagues, I believe it won't cause troubles for
us. We
> > > had to give view-applications: the admin console wouldn't work
properly,
> > > but this is also OK according to our requirements.
> > >
> > > Would you mind giving us some feedback on [1]? We wrote this to
> > experiment
> > > a bit with the proposal, but I'm not familiar with keycloak's
source
or
> > > practices. What should I do to help get this merged?
> > >
> > > [1]
https://github.com/keycloak/keycloak/compare/master...tpresa:master
> > >
> > > On Fri, Mar 27, 2015 at 10:51 AM, Stian Thorgersen <stian(a)redhat.com
>
> > wrote:
> > >
> > > >
> > > >
> > > > ----- Original Message -----
> > > > > From: "Thiago Presa"
<thiago.addevico(a)gmail.com>
> > > > > To: "Stian Thorgersen" <stian(a)redhat.com>
> > > > > Cc: keycloak-user(a)lists.jboss.org
> > > > > Sent: Friday, 27 March, 2015 2:01:56 PM
> > > > > Subject: Re: [keycloak-user] Application Management
> > > > >
> > > > > Ah, yes, I didn't understand your proposal properly.
Wouldn't
giving
> > > > > manage-users to app-admins wouldn't cause trouble, since
app-admins
> > could
> > > > > create and modify user accounts?
> > > >
> > > > Whether or not it's causing trouble depends on your
requirements,
but
> > yes,
> > > > they could create and modify user accounts, but not grant more
> > privileges.
> > > >
> > > > If you need to go beyond this one alternative is to wrap the admin
> > > > endpoints in your own application. We've just got so much on our
plate
> > at
> > > > the moment that we can't provide this level of control on
permissions.
> > > >
> > > > >
> > > > > On Fri, Mar 27, 2015 at 1:58 AM, Stian Thorgersen <
stian(a)redhat.com>
> > > > wrote:
> > > > >
> > > > > > Well, yes.. I told you it was a bit rubbish and would need
some
> > > > re-design
> > > > > > to implement more fine grained permissions. Doing that is
a
> > relatively
> > > > big
> > > > > > task and is not a high priority for us ATM.
> > > > > >
> > > > > > I'm a bit confused by this email as I proposed a
simple
solution
> > that
> > > > > > would resolve your requirements. If an admin can only
grant
> > permissions
> > > > > > that admin has access to all you have to do is to create
an
admin
> > that
> > > > can
> > > > > > only access roles for certain applications and your
problem
should
> > be
> > > > > > solved. That's a simple solution that we can add soon.
> > > > > >
> > > > > > ----- Original Message -----
> > > > > > > From: "Thiago Presa"
<thiago.addevico(a)gmail.com>
> > > > > > > To: "Stian Thorgersen"
<stian(a)redhat.com>
> > > > > > > Cc: keycloak-user(a)lists.jboss.org
> > > > > > > Sent: Thursday, 26 March, 2015 8:10:07 PM
> > > > > > > Subject: Re: [keycloak-user] Application Management
> > > > > > >
> > > > > > > So I've spent the last couple of days playing with
the
source.
> > :-)
> > > > > > >
> > > > > > > The current authorization mechanism is based on
Realm/RealmApp
> > i.e.
> > > > > > > whenever an API resource is called, check if the User
has the
> > > > required
> > > > > > > Right (manage, any, view) in the resource's
Realm/RealmApp.
> > > > > > >
> > > > > > > Consider, for example, the URI
> > > > > > >
> > > >
/admin/realms/{realm}/applications-by-id/{app-name}/roles/{role-name}.
> > > > > > What
> > > > > > > I was trying to do is to create a permission for
{app-name}
so
> > that
> > > > this
> > > > > > > API call wouldn't require any Realm/RealmApp
right.
> > > > > > >
> > > > > > > The problem I see is that this API call trigger many
methods
> > (i.e.
> > > > > > > AdminRoot#getRealmsAdmin,
RealmsAdminResource#getRealmAdmin,
> > > > > > > RealmAdminResource#getApplicationsById, and so on...),
and at
> > those
> > > > > > methods
> > > > > > > there is not enough information to figure out whether
this
is:
> > > > > > >
> > > > > > > 1- An app-specific call and thus should be authorized
even
> > without
> > > > realm
> > > > > > > authorization, or;
> > > > > > > 2- Not app-specific call and this should be properly
authorized
> > by
> > > > > > > Realm/RealmApp.
> > > > > > >
> > > > > > > Even in the case of (1), the information on which app
should
I
> > check
> > > > for
> > > > > > > authorization is not available.
> > > > > > >
> > > > > > > So it seems to me that this resource-loading
mechanisms
> > pressuposes
> > > > an
> > > > > > > authorization mechanism that checks only against the
realm
for
> > > > > > permission,
> > > > > > > and changing this seems daunting to me.
> > > > > > >
> > > > > > > Do you guys have any idea on a more local change I
could
make to
> > > > achieve
> > > > > > > the intended behavior?
> > > > > > >
> > > > > > > On Tue, Mar 24, 2015 at 2:33 PM, Thiago Presa <
> > > > thiago.addevico(a)gmail.com
> > > > > > >
> > > > > > > wrote:
> > > > > > >
> > > > > > > > OK, agreed. We thought this out of consistency,
but if
that's
> > not a
> > > > > > good
> > > > > > > > design we surely can consider a better one.
> > > > > > > >
> > > > > > > > On Tue, Mar 24, 2015 at 9:44 AM, Stian Thorgersen
<
> > > > stian(a)redhat.com>
> > > > > > > > wrote:
> > > > > > > >
> > > > > > > >>
> > > > > > > >>
> > > > > > > >> ----- Original Message -----
> > > > > > > >> > From: "Thiago Presa"
<thiago.addevico(a)gmail.com>
> > > > > > > >> > To: stian(a)redhat.com
> > > > > > > >> > Cc: keycloak-user(a)lists.jboss.org
> > > > > > > >> > Sent: Tuesday, 24 March, 2015 1:41:16
PM
> > > > > > > >> > Subject: Re: [keycloak-user] Application
Management
> > > > > > > >> >
> > > > > > > >> > Hi there,
> > > > > > > >> >
> > > > > > > >> > I'm Alex's coworker and I'll
be working on this too.
> > > > > > > >> >
> > > > > > > >> > We were just discussing your idea, and
it seems to fit
our
> > > > > > requirements.
> > > > > > > >> >
> > > > > > > >> > As far as we have seen, keycloak already
has a
realm-admin
> > > > concept.
> > > > > > > >> > Whenever a realm "R" is
created, it creates a R-realm
> > > > application
> > > > > > with
> > > > > > > >> > a bunch of default roles (manage-users,
manage-roles,
etc.)
> > > > into the
> > > > > > > >> > realm master.
> > > > > > > >> >
> > > > > > > >> > We are currently thinking if we could
mimic this
structure
> > for
> > > > > > > >> > applications. What do you think?
> > > > > > > >>
> > > > > > > >> It's already messy with the way I
modelled it and adding
the
> > same
> > > > for
> > > > > > > >> applications would be even worse. I don't
see why that's
> > needed
> > > > > > though if
> > > > > > > >> we'd add what I proposed.
> > > > > > > >>
> > > > > > > >> >
> > > > > > > >> > > I had an idea a while back that is
a simple way to
achieve
> > > > what
> > > > > > you're
> > > > > > > >> > > asking for. Th> e idea would be
to only allow an
admin to
> > > > grant
> > > > > > roles
> > > > > > > >> that
> > > > > > > >> > > the admin has access to.
> > > > > > > >> >
> > > > > > > >> > > Basically:> * A user with admin
(super user) role can
> > grant
> > > > any
> > > > > > roles
> > > > > > > >> (we
> > > > > > > >> > > would need to add a per-> realm
super user role)
> > > > > > > >> >
> > > > > > > >> > > * A user with the role manage-users
and some roles on
> > app1 can
> > > > > > only
> > > > > > > >> grant
> > > > > > > >> > > other users > the roles on app1
> > > > > > > >> >
> > > > > > > >> > > * A user with the role manage-users
and some roles on
> > app2 can
> > > > > > only
> > > > > > > >> grant
> > > > > > > >> > > other users > the roles on app2
> > > > > > > >> >
> > > > > > > >> > >
> > > > > > > >> >
> > > > > > > >> > > This is something we should add in
either case (to
prevent
> > > > users
> > > > > > > >> granting
> > > > > > > >> > themselves more access). Would it solve
your problems?
> > > > > > > >> >
> > > > > > > >>
> > > > > > > >
> > > > > > > >
> > > > > > >
> > > > > >
> > > > >
> > > >
> > >
> >
>
4016
days inactive
4058
days old
12 comments
3 participants
participants (3)
-
Leonardo Loch Zanivan -
Stian Thorgersen -
Thiago Presa