Keycloak set group as owner of resource

user_6718334 0
Viewed 3023

I am new to Keycloak and I try to use it as authentication server in my solution.

I have the following entity's model: the devices are owned by a particular company to which some users belong. User with role admin can grant permission for viewing some set of devices to a regular user but only those devices that belong to the admin's company. Thus all users except admins can view only a subset of all devices in company. Based on these requirements, I decided to make companies as groups and devices as Keycloak's resources. To evaluate permissions, I chose rule based policy.

The question is -- Can I set group as an owner of resource to check this relation in policy?

If someone is more experienced in keycloak and knows how to better represent such model, please help.

Thank you in advance.

abac keycloak authorization
2 Answers
  • As working on keycloak, I didn't find any way to set the multiple owners for particular resources.
  • I'm having the alternate option to give the access permission, that owners have for their resources.
  • Let say Resource A owner is OWNER A, now there are two more user USER A and USER B. If suppose OWNER A already share the access permission to USER A and USER A wants to share Resource A to USER B on behalf of the Resource owner, then how should USER A can share the resource scopes to USER B?

Answer

  • Keycloak provides the facility of token exchanging or impersonation feature. With the help of this USER A can able to share the resources to USER B on behalf of the OWNER A (Owner of Resource A).
  • Reference: You just need to follow this Keycloak Impersonation

Add comments if you still face the problem

user_103250040

In Keycloak, you may represent a particular company (or any organization or organizational unit) as a realm: https://www.keycloak.org/docs/latest/server_admin/index.html#core-concepts-and-terms Create a new realm: https://www.keycloak.org/docs/latest/server_admin/index.html#_create-realm

Then represent the company's users as users in the company's Keycloak realm https://www.keycloak.org/docs/latest/server_admin/index.html#user-management

... and devices as Keycloak Clients (any kind of resource you want enforce permissions on is a Client in Keycloak model): https://www.keycloak.org/docs/latest/server_admin/index.html#core-concepts-and-terms

An admin role is already defined by default for each role (Roles menu).

Instructions tested on Keycloak 4.0.0.

For each device, create the corresponding Client in Keycloak (Clients menu). Switch on Permissions Enabled on the Permissions tab of the new client. A list of admin console permissions will appear just below the switch button, such as the view permission.

Then, in order to assign the permission to view the device to some user, the admin should click on the view permission (link) just mentioned, create a User Policy (Create Policy... listbox) and select the users (assignees) in the Users field.

In order to assign the permission on multiple devices to the same group of people, use a Group or Role Policy instead (put the users in the same group before).

In order to assign the permission to groups of devices, use one Group/Role per group of device, then assign users to the Group/Role.

user_58522810
Related