HI there, We've integrated Keycloak auth and authz to an existing REST service which serves endpoints like this: GET /api/report?country={country} GET /api/status?country={country} GET /api/history?country={country} As far as I understand, the only way to protect these resources is to create "global" resources (/api/report, /api/status etc.), but then we can't validate if the current user is authorized to make requests for a given "country": The other alternative would be to include the country name in the URI, but this would lead to duplication of resource definitions: /api/report/country1 /api/report/country2 /api/status/country1 /api/status/country2 ... We considered including a list of the countries the user has access to as an attribute in the access_token but that would require manually maintaining said attribute Is there another way that would accommodate this kind of authentication requirements? Thanks in advance! -- *Gabriel Trisca, Software Developer* Cignifi | 101 Main Street, 14th Floor, Cambridge, MA 02142 USA _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

Hi Pedro, Thanks for your reply. Adding the country to the URI would that mean that I have to create all of the resources again for every new country that I add, correct?

Is there any way to avoid duplicating resources where the only thing that changes in the URI is the {country}?

Thanks! On Fri, Mar 31, 2017 at 10:17 AM, Pedro Igor Silva <psilva(a)redhat.com&gt; wrote: > What about using patterns in your paths. Something like: > > /api/report/{country} > > > On Thu, Mar 30, 2017 at 6:59 PM, Gabriel Trisca <gtrisca(a)cignifi.com&gt; > wrote: > >> HI there, >> >> We've integrated Keycloak auth and authz to an existing REST service >> which >> serves endpoints like this: >> >> GET /api/report?country={country} >> GET /api/status?country={country} >> GET /api/history?country={country} >> >> As far as I understand, the only way to protect these resources is to >> create "global" resources (/api/report, /api/status etc.), but then we >> can't validate if the current user is authorized to make requests for a >> given "country": >> >> The other alternative would be to include the country name in the URI, >> but >> this would lead to duplication of resource definitions: >> >> /api/report/country1 >> /api/report/country2 >> /api/status/country1 >> /api/status/country2 >> ... >> >> We considered including a list of the countries the user has access to as >> an attribute in the access_token but that would require manually >> maintaining said attribute >> >> Is there another way that would accommodate this kind of authentication >> requirements? >> >> Thanks in advance! >> >> -- >> *Gabriel Trisca, Software Developer* >> Cignifi | 101 Main Street, 14th Floor, Cambridge, MA 02142 USA >> _______________________________________________ >> keycloak-user mailing list >> keycloak-user(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/keycloak-user >> > > -- *Gabriel Trisca, Software Developer* Cignifi | 101 Main Street, 14th Floor, Cambridge, MA 02142 USA P: +1 857-209-2685 <(857)%20209-2685> • M: +1 301-433-2221 <(301)%20433-2221> | www.cignifi.com

Maybe define a resource for each country then a scope each for "report", "status" and "history"? You'd have to handle authorization yourself in your app by looking at the RPT though. On 3/31/17 10:17 AM, Pedro Igor Silva wrote: > What about using patterns in your paths. Something like: > > /api/report/{country} > > > On Thu, Mar 30, 2017 at 6:59 PM, Gabriel Trisca <gtrisca(a)cignifi.com&gt; wrote: > >> HI there, >> >> We've integrated Keycloak auth and authz to an existing REST service which >> serves endpoints like this: >> >> GET /api/report?country={country} >> GET /api/status?country={country} >> GET /api/history?country={country} >> >> As far as I understand, the only way to protect these resources is to >> create "global" resources (/api/report, /api/status etc.), but then we >> can't validate if the current user is authorized to make requests for a >> given "country": >> >> The other alternative would be to include the country name in the URI, but >> this would lead to duplication of resource definitions: >> >> /api/report/country1 >> /api/report/country2 >> /api/status/country1 >> /api/status/country2 >> ... >> >> We considered including a list of the countries the user has access to as >> an attribute in the access_token but that would require manually >> maintaining said attribute >> >> Is there another way that would accommodate this kind of authentication >> requirements? >> >> Thanks in advance! >> >> -- >> *Gabriel Trisca, Software Developer* >> Cignifi | 101 Main Street, 14th Floor, Cambridge, MA 02142 USA >> _______________________________________________ >> keycloak-user mailing list >> keycloak-user(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/keycloak-user >> > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

Hi Gabriel, How do you define your policies? which adapter do you use for your app? On Thu, Mar 30, 2017 at 11:59 PM, Gabriel Trisca <gtrisca(a)cignifi.com&gt; wrote: > HI there, > > We've integrated Keycloak auth and authz to an existing REST service which > serves endpoints like this: > > GET /api/report?country={country} > GET /api/status?country={country} > GET /api/history?country={country} > > As far as I understand, the only way to protect these resources is to > create "global" resources (/api/report, /api/status etc.), but then we > can't validate if the current user is authorized to make requests for a > given "country": > > The other alternative would be to include the country name in the URI, but > this would lead to duplication of resource definitions: > > /api/report/country1 > /api/report/country2 > /api/status/country1 > /api/status/country2 > ... > > We considered including a list of the countries the user has access to as > an attribute in the access_token but that would require manually > maintaining said attribute > > Is there another way that would accommodate this kind of authentication > requirements? > > Thanks in advance! > > -- > *Gabriel Trisca, Software Developer* > Cignifi | 101 Main Street, 14th Floor, Cambridge, MA 02142 USA > _______________________________________________ > keycloak-user mailing list > keycloak-user(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-user >

Hi Gabriel Thanks for the note. I need to secure Orion. Orion is a C++ implementation of the NGSI9/10 REST API binding developed as a part of the FIWARE platform. I could not find any adapter in KeyCloak. So how we could secure Orion? https://github.com/telefonicaid/fiware-orion#api-overview On Mon, Apr 10, 2017 at 3:27 PM, Gabriel Trisca <gtrisca(a)cignifi.com&gt; wrote: > Hi Mehdi, > > The policies are defined in the Keycloak admin panel, and we want to try > to avoid defining access control in out application code as much as > possible. The application uses Dropwizard, so we use the Jetty adapter. > > Thanks! > > On Mon, Apr 10, 2017 at 8:27 AM, Mehdi Sheikhalishahi < > mehdi.alishahi(a)gmail.com&gt; wrote: > >> Hi Gabriel, >> >> How do you define your policies? which adapter do you use for your app? >> >> On Thu, Mar 30, 2017 at 11:59 PM, Gabriel Trisca <gtrisca(a)cignifi.com&gt; >> wrote: >> >>> HI there, >>> >>> We've integrated Keycloak auth and authz to an existing REST service >>> which >>> serves endpoints like this: >>> >>> GET /api/report?country={country} >>> GET /api/status?country={country} >>> GET /api/history?country={country} >>> >>> As far as I understand, the only way to protect these resources is to >>> create "global" resources (/api/report, /api/status etc.), but then we >>> can't validate if the current user is authorized to make requests for a >>> given "country": >>> >>> The other alternative would be to include the country name in the URI, >>> but >>> this would lead to duplication of resource definitions: >>> >>> /api/report/country1 >>> /api/report/country2 >>> /api/status/country1 >>> /api/status/country2 >>> ... >>> >>> We considered including a list of the countries the user has access to >>> as >>> an attribute in the access_token but that would require manually >>> maintaining said attribute >>> >>> Is there another way that would accommodate this kind of authentication >>> requirements? >>> >>> Thanks in advance! >>> >>> -- >>> *Gabriel Trisca, Software Developer* >>> Cignifi | 101 Main Street, 14th Floor, Cambridge, MA 02142 USA >>> _______________________________________________ >>> keycloak-user mailing list >>> keycloak-user(a)lists.jboss.org >>> https://lists.jboss.org/mailman/listinfo/keycloak-user >>> >> >> > > > -- > *Gabriel Trisca, Software Developer* > Cignifi | 101 Main Street, 14th Floor, Cambridge, MA 02142 USA > P: +1 857-209-2685 <+1%20857-209-2685> • M: +1 301-433-2221 > <+1%20301-433-2221> | www.cignifi.com >