Re: [security-dev] how to model services managed by a realm

----- Original Message ----- This is possible, but I'm not sure how much this is a workaround :). I think is better wait for PLINK-130, then you can use your custom identity types to better satisfy your requirements. There are other alternatives that I can think of, but none of them looks better then using tiers for application-specific roles and groups and realms for users. Which does not fit your requirements, as you said. The main idea behind tiers are to share role/groups between realms. And not tie them to a specific realm. From the documentation: "A Tier is a more restrictive type of partition than a realm, as it only allows groups and roles to be defined (but not users). A Tier may be used to define a set of application-specific groups and roles, which may then be assigned to groups within the same Tier, or to users and groups within a separate Realm." I think I have discussed that with Shane some time ago about attributes on partitions. Need to recall that. But I agree that partition-scoped attributes can be handy.