[keycloak-user] Scope Permissions with Resource Type

[Farzad Panahi]

Thanks Pedro. I will check it out. Let us know here when you create that UI
JIRA ticket.

On Fri, Jun 14, 2019 at 6:44 AM Pedro Igor Silva <psilva at redhat.com> wrote:

> Yeah, I do. I've been thinking about this for a while and I think it would
> make permission mgmt more easy without too many choices on how to do it. It
> should be a quite trivial change as both share the same model. More a UI
> refactoring.
>
> Will create a JIRA for it.
>
> FYI, I've just pushed some changes for allowing people to configure a
> global decision strategy so that you change how permissions are evaluated.
> Please, take a look at
> https://github.com/keycloak/keycloak-documentation/pull/680. Maybe it can
> also help your use case.
>
> On Thu, Jun 13, 2019 at 3:56 PM Farzad Panahi <farzad.panahi at gmail.com>
> wrote:
>
>> Thanks Pedro. I will try this out.
>>
>> BTW, do you think merging the resource-based and scope-based permissions
>> would be in your roadmap for anytime soon?
>>
>> On Mon, Jun 10, 2019 at 2:17 PM Pedro Igor Silva <psilva at redhat.com>
>> wrote:
>>
>>> There is a limitation here in how resource types are used. You could
>>> achieve that if RESOURCE_1, RESOURCE_2 and RESOURCE_3 were "resource
>>> instance", with the owner other than the resource server. But this does not
>>> seem to be your case.
>>>
>>> There is one way to achieve this by using a JS Policy. Still not ideal,
>>> but something like this:
>>>
>>> ====
>>> var permission = $evaluation.getPermission();
>>> var scopes = permission.getScopes();
>>>
>>> for (i = 0; i < scopes.length; i++) {
>>>     var scope = scopes.get(i);
>>>
>>>     if (scope.getName().equals("read")) {
>>>         if (// check here if the user is member of a group) {
>>>             permission.getScopes().remove(scope);
>>>         }
>>>     }
>>> }
>>>
>>> // grant or deny the permission
>>> ====
>>>
>>> To check if a user is a member of a group, please take a look at
>>> https://www.keycloak.org/docs/latest/authorization_services/index.html#checking-for-group-membership
>>> .
>>>
>>> On Mon, Jun 10, 2019 at 4:44 PM Farzad Panahi <farzad.panahi at gmail.com>
>>> wrote:
>>>
>>>> Hi Pedro,
>>>>
>>>> If I create a scope-based permission without specifying the resource,
>>>> then that permission will apply to all the resources.
>>>> For instance in the example I mentioned in my previous email:
>>>>
>>>> I want to create permissions to give only SCOPE_READ access (not
>>>> SCOPE_WRITE access) to USER_GROUP_A for RESOURCE_TYPE_ALPHA.
>>>>
>>>> If I grant a permission for SCOPE_READ without specifying the resource
>>>> then basically I am granting SCOPE_READ to all the resources which is not
>>>> what I want. I want to only give SCOPE_READ to a specific set of resources.
>>>>
>>>> I think as you mentioned merging resource-based and scope-based
>>>> permissions is a good idea and would work better. But now that we do not
>>>> have this feature is there any other way to accomplish this somehow using
>>>> policies or something else?
>>>>
>>>> Cheers
>>>>
>>>> Farzad
>>>>
>>>> On Mon, Jun 10, 2019 at 5:22 AM Pedro Igor Silva <psilva at redhat.com>
>>>> wrote:
>>>>
>>>>> You can create scope-based permission for a specific scope (without
>>>>> set a resource). Would that help?
>>>>>
>>>>> I think we could also think about merging resource-based permission
>>>>> into scope-based permission so that we only have a single type of
>>>>> permission.
>>>>>
>>>>> Regards.
>>>>> Pedro Igor
>>>>>
>>>>> On Fri, Jun 7, 2019 at 6:09 PM Farzad Panahi <farzad.panahi at gmail.com>
>>>>> wrote:
>>>>>
>>>>>> Hi,
>>>>>>
>>>>>> I have a client authorization set-up like the following:
>>>>>>
>>>>>> RERSOURCE_1:  [SCOPE_READ, SCOPE_WRITE], RESOURCE_TYPE_ALPHA
>>>>>> RERSOURCE_2:  [SCOPE_READ, SCOPE_WRITE], RESOURCE_TYPE_ALPHA
>>>>>> RERSOURCE_3:  [SCOPE_READ, SCOPE_WRITE], RESOURCE_TYPE_ALPHA
>>>>>>
>>>>>> USER_1: USER_GROUP_A
>>>>>> USER_2: USER_GROUP_A
>>>>>>
>>>>>> USER_GROUP_A_POLICY: GRANT ACCESS TO USER_GROUP_A
>>>>>>
>>>>>> I want to create permissions to give only SCOPE_READ access (not
>>>>>> SCOPE_WRITE access) to USER_GROUP_A for RESOURCE_TYPE_ALPHA.
>>>>>>
>>>>>> If I create a resourced based permission then it will give grant
>>>>>> access to
>>>>>> both scopes.
>>>>>> Unfortunately I cannot create a scope based permission because scope
>>>>>> permission does not support resource type. It only supports resource.
>>>>>> If I
>>>>>> want to use scoped based permission then I have to create permission
>>>>>> for
>>>>>> every single resource in my resource type.
>>>>>>
>>>>>> I was wondering if there is a reason that scope based permission does
>>>>>> not
>>>>>> support resource type?
>>>>>>
>>>>>> Also anyone has any idea how I can achieve my requirement given the
>>>>>> limitations that we have? Is there a way to create a policy that
>>>>>> grants
>>>>>> access only to a certain scope?
>>>>>>
>>>>>>
>>>>>> Cheers
>>>>>>
>>>>>> Farzad
>>>>>> _______________________________________________
>>>>>> keycloak-user mailing list
>>>>>> keycloak-user at lists.jboss.org
>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>
>>>>>