Hi Bill, First of all, custom IdentityType implementations are targeted for Beta5 and is related with PLINK-130. That said and considering what we have today, I would consider mapping applications as realms. If I understood your use case correctly, each application has its own users, roles, groups and relationships between them, not visible or accessible by others. A realm will allow you to organize identity data per application, where you can have the same user, role and group (with the same loginName or name) between different realms. Maybe this example application can be useful to demonstrate how to handle different realms in a multi-tennancy architecture (using realms, only). https://github.com/pedroigor/jboss-as-quickstart/tree/master/picketlink-a... Another way to organize identity data is using tiers. Tiers, different than realms, can be used to store only roles and groups. So, if you want to share users you can use a single realm to store them and use a specific tier for each application where its specific roles and groups are located. The Query API is ready to give you what you want if you use both approaches: - What roles or groups an application have - What roles or groups an user is related with You can get which applications are supported by getting from the IdentityManagerFactory which realms or tiers are configured. Regards. Pedro Igor ----- Original Message ----- From: "Bill Burke" <bburke(a)redhat.com&gt; To: security-dev(a)lists.jboss.org Sent: Monday, June 10, 2013 8:49:26 PM Subject: Re: [security-dev] how to model services managed by a realm I guess an Application would be an Agent. Application role names could either be scoped, i.e. "ApplicationName.RoleName" or I could generate a unique id for the Role.getName() and add a special "applicationRoleName" attribute. Then create a custom relationship between the Appplication's Agent and each role. That sound right? Should I scope the name, or generate a unique id and add an attribute? On 6/10/2013 6:28 PM, Bill Burke wrote: -- Bill Burke JBoss, a division of Red Hat http://bill.burkecentral.com _______________________________________________ security-dev mailing list security-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/security-dev

----- Original Message ----- Custom relationships are supported, but IdentityTypes not yet. I see. I was thinking about each "application" having only a reference for a single user (same user maps to different accounts in twitter, google and fb, for example). But this is another scenario. Please, take a look at: https://github.com/picketlink/picketlink/blob/master/modules/idm/tests/sr... I think we don't support this kind of query. But you can always get all users, groups or roles for a specific partition.

----- Original Message ----- This is possible, but I'm not sure how much this is a workaround :). I think is better wait for PLINK-130, then you can use your custom identity types to better satisfy your requirements. There are other alternatives that I can think of, but none of them looks better then using tiers for application-specific roles and groups and realms for users. Which does not fit your requirements, as you said. The main idea behind tiers are to share role/groups between realms. And not tie them to a specific realm. From the documentation: "A Tier is a more restrictive type of partition than a realm, as it only allows groups and roles to be defined (but not users). A Tier may be used to define a set of application-specific groups and roles, which may then be assigned to groups within the same Tier, or to users and groups within a separate Realm." I think I have discussed that with Shane some time ago about attributes on partitions. Need to recall that. But I agree that partition-scoped attributes can be handy.

----- Original Message ----- I'll open a JIRA, would be nice have a feedback from Shane too.

Bill, I'm currently working on some changes that will allow you to create a custom Partition type, so you'll be able to do something like this: @IdentityPartition(supportedTypes = {Role.class, Group.class}) public class Application implements Partition { private String id; private String name; // snip getters/setters } The supportedTypes member of the annotation allows you to define which identity types can be persisted in your particular partition implementation. I'll also be changing the Partition interface to extend AttributedType (which has getAttribute/setAttribute methods), so it will support setting arbitrary attribute values for partitions, as well as being able to declare formal attributes on the partition implementation itself. I'm a bit unclear about the use case for associating a Realm with Tiers - could you please elaborate on this? On 12/06/13 00:14, Bill Burke wrote:

On 13/06/13 07:05, Bill Burke wrote: Yes, it was an oversight that this isn't already supported and Pedro has raised a JIRA issue [1] to track it. It is essentially a configuration issue and we'll likely support it via the IdentityManagerFactory interface. This is already possible without an association between the Realm and the Application, however we can probably add support for associations between partitions if you think it will be a useful feature. I would probably implement this by storing the actual token values as an attribute of the User, and then using the relationships API to define the role mappings: public class TokenRole extends AbstractAttributedType implements Relationship { // User private User user; // Application role that this token applies to private Role role; private String tokenCode; // snip getters/setters } You would then execute a relationship query to determine which application roles the user has assigned for a particular token. As previous, I would create a custom Application partition type and not try to shoe-horn it into an existing type. I agree about LDAP, it's not designed for multi-partition support and federating is the way to achieve what you're describing. You could store just the basic user data in LDAP and everything else in a JPA or JDBC store, just like you say. [1] https://issues.jboss.org/browse/PLINK-189