[security-dev] how to model services managed by a realm

[Bill Burke]

On 6/11/2013 11:27 PM, Shane Bryzak wrote:
> Bill,
>
> I'm currently working on some changes that will allow you to create a
> custom Partition type, so you'll be able to do something like this:
>
> @IdentityPartition(supportedTypes = {Role.class, Group.class})
> public class Application implements Partition {
>       private String id;
>       private String name;
>
>       // snip getters/setters
> }
>

Will what you're working on allow you to create partitions on the fly? 
Right now, tiers and realms must be preknown and fixed for the lifetime 
of the IdentityManagerFactory.  I just finished some work to allow File 
and JPA-based stores to be able to create and find partitions and was 
about to submit a pull request.

> The supportedTypes member of the annotation allows you to define which
> identity types can be persisted in your particular partition implementation.
>
> I'll also be changing the Partition interface to extend AttributedType
> (which has getAttribute/setAttribute methods), so it will support
> setting arbitrary attribute values for partitions, as well as being able
> to declare formal attributes on the partition implementation itself.
>
> I'm a bit unclear about the use case for associating a Realm with Tiers
> - could you please elaborate on this?
>

There is a company-wide set of users.  This is the Realm.  A company has 
a set of distributed applications, each of these applications has their 
own role sets.  I want to assign role mappings from the realm, to each 
one of these applications.

 From a management perspective you'll want to be able to manage all 
application user-role mappings from a specific Realm, or add/remove 
roles from an application.  To be able to do this, you need to know 
which applications are managed by the Realm.

Also, I want to be able to create a token for an individual 
authenticated user that contains role mappings for each application 
within the realm.

All this needs to work in a SaaS model, where multiple realms can be 
created and managed.

Pedro suggested that I model each Application as a Tier, but I'm having 
doubts about this because LDAP doesn't currently support the notion of a 
partition.  Maybe I could federate this?  Store username/credentials in 
the company's LDAP store, but store application, roles, and role 
mappings within a local store?  Is this type of application data even 
stored in LDAP in reality?


-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com