11:42 a.m.
Hi All,
In our application, we integrate with Microsoft AD for authenticating users. As part of
the authentication result, we also fetch group information for the user authenticated. We
also have a pre-defined group-role mapping defined in the application server [This is a
JEE configuration file]. This helps decide whether a particular user based on the role he
belongs to can access a resource or not. I read another thread "Apply group
membership filter on ldap login
<http://lists.jboss.org/pipermail/keycloak-user/2015-December/003982.html> " on
similar lines. Couple of clarifications.
1. Based on what I read there is no feature to get roles and map them to specific
roles in keycloak and would be available in a future release. I just wanted to understand
if my reading of this is on the right lines. Also, wanted to know if there's a
workaround for this in the short term.
2. Also does keycloak provide fine grained access control on the lines of apache
shiro?
Thanks
Prasad
3:46 a.m.
On 30/12/15 18:42, Mahantesh Prasad Katti wrote:
Hi All,
In our application, we integrate with Microsoft AD for authenticating
users. As part of the authentication result, we also fetch group
information for the user authenticated. We also have a pre-defined
group-role mapping defined in the application server [This is a JEE
configuration file]. This helps decide whether a particular user based
on the role he belongs to can access a resource or not. I read another
thread “Apply group membership filter on ldap login
<http://lists.jboss.org/pipermail/keycloak-user/2015-December/003982.html&...
on similar lines. Couple of clarifications.
1.Based on what I read there is no feature to get roles and map them
to specific roles in keycloak and would be available in a future
release. I just wanted to understand if my reading of this is on the
right lines. Also, wanted to know if there’s a workaround for this in
the short term.
The feature to get LDAP roles and map them to specific roles in Keycloak
is available. We have LDAP Role Mapper (See documentation
http://keycloak.github.io/docs/userguide/keycloak-server/html/user_federa...
and our ldap example for details).
The thread "Apply group membership filter on ldap login" is more about
restricting that some LDAP users are not able to login at all (For
example, specify that just users, which are members of LDAP group
"cn=mygroup,o=myorg,dc=example,dc=com" are able to login and all the
other users are filtered). This will be available from 1.8 release (it's
in master already).
2.Also does keycloak provide fine grained access control on the lines
of apache shiro?
Keycloak provides SSO and authentication. Once you authenticate, your
application will receive access token with the roles of user from
Keycloak (We have stuff like scope, protocol mappers etc, which allows
better control under what exactly will go to access token. See docs and
examples for details).
Then it's up to the application how it interprets roles from accessToken
. The authorization needs to be actually done by application itself
(unless it's JEE application where we have mapping of accessToken roles
to JEE roles. Again see examples). We have separate subproject under
development (no official release yet available), which will allow more
authorization possibilities.
Marek
Thanks
Prasad
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
8:02 a.m.
Thanks Marek. I looked at the built in example. I am looking for a couple of details.
1. What is the bind password for the embedded apache ds?
2. I had a quick look at the ldaprealm.json document. It turned out that group name
and the realm role name are identical. Is that a requirement for role-group mapping to
work in keycloak?
3. Also, is role to group mapping always one to one? In our application, one role is
invariably mapped to multiple ldap groups.
Regards,
Prasad
From: Marek Posolda [mailto:mposolda@redhat.com]
Sent: Monday, January 04, 2016 3:17 PM
To: Mahantesh Prasad Katti; keycloak-user(a)lists.jboss.org
Subject: Re: [keycloak-user] retrieving group membership info from LDAP/AD
On 30/12/15 18:42, Mahantesh Prasad Katti wrote:
Hi All,
In our application, we integrate with Microsoft AD for authenticating users. As part of
the authentication result, we also fetch group information for the user authenticated. We
also have a pre-defined group-role mapping defined in the application server [This is a
JEE configuration file]. This helps decide whether a particular user based on the role he
belongs to can access a resource or not. I read another thread "Apply group
membership filter on ldap login
<http://lists.jboss.org/pipermail/keycloak-user/2015-December/003982.html> " on
similar lines. Couple of clarifications.
1. Based on what I read there is no feature to get roles and map them to specific
roles in keycloak and would be available in a future release. I just wanted to understand
if my reading of this is on the right lines. Also, wanted to know if there's a
workaround for this in the short term.
The feature to get LDAP roles and map them to specific roles in Keycloak is available. We
have LDAP Role Mapper (See documentation
http://keycloak.github.io/docs/userguide/keycloak-server/html/user_federa...
and our ldap example for details).
The thread "Apply group membership filter on ldap login" is more about
restricting that some LDAP users are not able to login at all (For example, specify that
just users, which are members of LDAP group
"cn=mygroup,o=myorg,dc=example,dc=com" are able to login and all the other users
are filtered). This will be available from 1.8 release (it's in master already).
2. Also does keycloak provide fine grained access control on the lines of apache
shiro?
Keycloak provides SSO and authentication. Once you authenticate, your application will
receive access token with the roles of user from Keycloak (We have stuff like scope,
protocol mappers etc, which allows better control under what exactly will go to access
token. See docs and examples for details).
Then it's up to the application how it interprets roles from accessToken . The
authorization needs to be actually done by application itself (unless it's JEE
application where we have mapping of accessToken roles to JEE roles. Again see examples).
We have separate subproject under development (no official release yet available), which
will allow more authorization possibilities.
Marek
Thanks
Prasad
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
4:07 p.m.
On 08/01/16 15:02, Mahantesh Prasad Katti wrote:
Thanks Marek. I looked at the built in example. I am looking for a
couple of details.
1.What is the bind password for the embedded apache ds?
secret
See the property bindCredential in ldaprealm.json document
2.I had a quick look at the ldaprealm.json document. It turned out
that group name and the realm role name are identical. Is that a
requirement for role-group mapping to work in keycloak?
ATM yes. You may need to override RoleLDAPFederationMapper if you have
more fancy requirements around this.
3.Also, is role to group mapping always one to one? In our
application, one role is invariably mapped to multiple ldap groups.
I think you can create multiple Role LDAP federation mappers for your
federation provider. For example you can create mapper for 2 group trees
"ou=roles1,dc=example,dc=com" and "ou=roles2,dc=example,dc=com" . In
that case, if you create keycloak realm role "foo", it will be saved
into LDAP into both "cn=foo,ou=roles1,dc=example,dc=com" and
"cn=foo,ou=roles2,dc=example,dc=com" . If you assign some user into the
"foo" role in Keycloak, he will be always added as member into both LDAP
groups. The role mappings in Keycloak should be union of both LDAP
groups. For example if user "john" is declared as member in any of
"cn=foo,ou=roles1,dc=example,dc=com" or
"cn=foo,ou=roles2,dc=example,dc=com", he will be member of this role in
Keycloak.
Marek
Regards,
Prasad
*From:*Marek Posolda [mailto:mposolda@redhat.com]
*Sent:* Monday, January 04, 2016 3:17 PM
*To:* Mahantesh Prasad Katti; keycloak-user(a)lists.jboss.org
*Subject:* Re: [keycloak-user] retrieving group membership info from
LDAP/AD
On 30/12/15 18:42, Mahantesh Prasad Katti wrote:
Hi All,
In our application, we integrate with Microsoft AD for
authenticating users. As part of the authentication result, we
also fetch group information for the user authenticated. We also
have a pre-defined group-role mapping defined in the application
server [This is a JEE configuration file]. This helps decide
whether a particular user based on the role he belongs to can
access a resource or not. I read another thread “Apply group
membership filter on ldap login
<http://lists.jboss.org/pipermail/keycloak-user/2015-December/003982.html&...
on similar lines. Couple of clarifications.
1.Based on what I read there is no feature to get roles and map
them to specific roles in keycloak and would be available in a
future release. I just wanted to understand if my reading of this
is on the right lines. Also, wanted to know if there’s a
workaround for this in the short term.
The feature to get LDAP roles and map them to specific roles in
Keycloak is available. We have LDAP Role Mapper (See documentation
http://keycloak.github.io/docs/userguide/keycloak-server/html/user_federa...
and our ldap example for details).
The thread "Apply group membership filter on ldap login" is more about
restricting that some LDAP users are not able to login at all (For
example, specify that just users, which are members of LDAP group
"cn=mygroup,o=myorg,dc=example,dc=com" are able to login and all the
other users are filtered). This will be available from 1.8 release
(it's in master already).
2.Also does keycloak provide fine grained access control on the lines
of apache shiro?
Keycloak provides SSO and authentication. Once you authenticate, your
application will receive access token with the roles of user from
Keycloak (We have stuff like scope, protocol mappers etc, which allows
better control under what exactly will go to access token. See docs
and examples for details).
Then it's up to the application how it interprets roles from
accessToken . The authorization needs to be actually done by
application itself (unless it's JEE application where we have mapping
of accessToken roles to JEE roles. Again see examples). We have
separate subproject under development (no official release yet
available), which will allow more authorization possibilities.
Marek
Thanks
Prasad
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org <mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
8:12 p.m.
Thanks. Appreciate it.
-Prasad
From: Marek Posolda [mailto:mposolda@redhat.com]
Sent: Thursday, January 14, 2016 3:37 AM
To: Mahantesh Prasad Katti; keycloak-user(a)lists.jboss.org
Subject: Re: [keycloak-user] retrieving group membership info from LDAP/AD
On 08/01/16 15:02, Mahantesh Prasad Katti wrote:
Thanks Marek. I looked at the built in example. I am looking for a couple of details.
1. What is the bind password for the embedded apache ds?
secret
See the property bindCredential in ldaprealm.json document
2. I had a quick look at the ldaprealm.json document. It turned out that group name
and the realm role name are identical. Is that a requirement for role-group mapping to
work in keycloak?
ATM yes. You may need to override RoleLDAPFederationMapper if you have more fancy
requirements around this.
3. Also, is role to group mapping always one to one? In our application, one role is
invariably mapped to multiple ldap groups.
I think you can create multiple Role LDAP federation mappers for your federation provider.
For example you can create mapper for 2 group trees
"ou=roles1,dc=example,dc=com" and "ou=roles2,dc=example,dc=com" . In
that case, if you create keycloak realm role "foo", it will be saved into LDAP
into both "cn=foo,ou=roles1,dc=example,dc=com" and
"cn=foo,ou=roles2,dc=example,dc=com" . If you assign some user into the
"foo" role in Keycloak, he will be always added as member into both LDAP groups.
The role mappings in Keycloak should be union of both LDAP groups. For example if user
"john" is declared as member in any of
"cn=foo,ou=roles1,dc=example,dc=com" or
"cn=foo,ou=roles2,dc=example,dc=com", he will be member of this role in
Keycloak.
Marek
Regards,
Prasad
From: Marek Posolda [mailto:mposolda@redhat.com]
Sent: Monday, January 04, 2016 3:17 PM
To: Mahantesh Prasad Katti;
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>
Subject: Re: [keycloak-user] retrieving group membership info from LDAP/AD
On 30/12/15 18:42, Mahantesh Prasad Katti wrote:
Hi All,
In our application, we integrate with Microsoft AD for authenticating users. As part of
the authentication result, we also fetch group information for the user authenticated. We
also have a pre-defined group-role mapping defined in the application server [This is a
JEE configuration file]. This helps decide whether a particular user based on the role he
belongs to can access a resource or not. I read another thread "Apply group
membership filter on ldap login
<http://lists.jboss.org/pipermail/keycloak-user/2015-December/003982.html> " on
similar lines. Couple of clarifications.
1. Based on what I read there is no feature to get roles and map them to specific
roles in keycloak and would be available in a future release. I just wanted to understand
if my reading of this is on the right lines. Also, wanted to know if there's a
workaround for this in the short term.
The feature to get LDAP roles and map them to specific roles in Keycloak is available. We
have LDAP Role Mapper (See documentation
http://keycloak.github.io/docs/userguide/keycloak-server/html/user_federa...
and our ldap example for details).
The thread "Apply group membership filter on ldap login" is more about
restricting that some LDAP users are not able to login at all (For example, specify that
just users, which are members of LDAP group
"cn=mygroup,o=myorg,dc=example,dc=com" are able to login and all the other users
are filtered). This will be available from 1.8 release (it's in master already).
2. Also does keycloak provide fine grained access control on the lines of apache
shiro?
Keycloak provides SSO and authentication. Once you authenticate, your application will
receive access token with the roles of user from Keycloak (We have stuff like scope,
protocol mappers etc, which allows better control under what exactly will go to access
token. See docs and examples for details).
Then it's up to the application how it interprets roles from accessToken . The
authorization needs to be actually done by application itself (unless it's JEE
application where we have mapping of accessToken roles to JEE roles. Again see examples).
We have separate subproject under development (no official release yet available), which
will allow more authorization possibilities.
Marek
Thanks
Prasad
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
3648
days inactive
3663
days old
4 comments
2 participants
participants (2)
-
Mahantesh Prasad Katti -
Marek Posolda