Hi, You may be interested in the discussions [1] we had in the past with the community about data filtering/security. It should give you an idea about what we are missing and how to extend some of our capabilities to filter data on your application based on the permissions granted by Keycloak. It seems you can benefit from "pushed claims" in order to communicate a filter from your policies to your application so that you filter (dynamically) resources based on the user making a request. For the second part where you want to obtain shared resources, you could take a look at this quickstart [2]. Unfortunately, we don't have the API that allows you to manage shared resources documented. [1] https://lists.jboss.org/pipermail/keycloak-user/2018-November/016083.html [2] https://github.com/keycloak/keycloak-quickstarts/blob/latest/app-authz-ph... Regards. Pedro Igor On Wed, Aug 21, 2019 at 8:14 AM Asbjørn Dyhrberg Thegler < asbjoern(a)gmail.com&gt; wrote: > Hello there, > > I am implementing a Node.js resource server and I currently struggle with > figuring out how to let a user list all their resources from a specifict > resource set. > > For example, a user can GET /activities and get all their own activities, > but not other users. I am not certain of how to create a UMA permission > ticket for that request, since don't already know the IDs of the users > activities. Further, the user could have access to other users activities > through resource sharing. This list is potentially very large, (as in > thousands of IDs), and I don't imagine putting that large a JWT in a > header > is a good idea either. > > What is the recommended way to handle this? > > I am wondering if I should let the resource server itself query KeyCloak > for a list of IDs for all its own activities and activities shared with > the > user - but I can't seem to figure out what API endpoint that lets me do > this in KeyCloak 6.0.1, since the Entitlement API has been deprecated. > > Thanks for your help, I really enjoy working with KeyCloak so far. :) > > Regards, Asbjørn > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user