Maybe you can use Keycloak authorization services to achieve this. There is some support for the concept of "Owner", so that only user, who owns some object can do something with that object. I suggest to take a look at our quickstarts for the authorization [1], the documentation [2]. Also some time ago, I did a demo for the authorization services and it used Sprint & Sprint Security, so maybe you can take a look as well for the inspiration [3]. There is presentation of this available on Youtube as well. [1] https://github.com/keycloak/keycloak-quickstarts (All quickstarts starting with "app-authz" [2] https://www.keycloak.org/docs/latest/authorization_services/index.html [3] https://github.com/mposolda/devconf2019-authz/ Marek On 03. 12. 19 16:47, Alfonso Vidal García wrote: