Repository navigation
Add a per-user view of UMA resources to the admin console #53780
muhammedogz
started this conversation in
Ideas
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
I turned on User-Managed Access in a realm and gave a user resources in two clients. The user sees everything in one list in the account console. As an admin I can't get that list anywhere.
This is the user's page. Resources from two clients, one of them shared, one with a pending request, all in one list.
On the admin side resources only exist per client. I have to open each client's Authorization tab and filter by owner.
The user page has no Resources tab at all.
With ten clients that is ten pages, or a script against the per-client admin endpoint. Shares and pending requests are worse, there is no admin view of them at all. When support gets asked "what does this user own and who did they share it with", the only way to find out today is to impersonate the user.
The odd part is that the backend already does the cross-client query.
GET /realms/{realm}/account/resourcescalls the resource store with a null resource server, which means all clients. The admin API never got the same endpoint.As a first step I'd add a read-only
GET /admin/realms/{realm}/users/{id}/resourcesthat uses the same store query as the account service. It needsviewon the user, and under fine-grained permissions it drops rows from clients the admin can't view. The UI part is a Resources tab on the user page showing name, owning client, type, scopes and the UMA flag. The client column links to that client's Authorization page, so editing stays where it is today. I'd also add tests, a release note and a line in the authorization guide.Sharing and permission tickets I'd leave for a second PR. The admin side has nothing for tickets right now and I don't want to mix the two.
Two things I'm unsure about. The response needs the owning client, so either a new representation or a field on
ResourceRepresentation. I'd rather not touchResourceRepresentationsince it's part of the UMA protocol responses. And should the tab show always, or only when the realm has user-managed access on? Resources withownerManagedAccesscan exist either way, so I lean towards always.If the direction is fine I'll do the implementation.
All reactions