"GitHub Organizations"-style RBAC in Keycloak? #12322

ross-nordstrom · 2022-06-03T01:30:48Z

ross-nordstrom
Jun 3, 2022

I was wondering if anyone has suggestions or design patterns for how to build RBAC in Keycloak that matches GitHub Organizations?

Single login
User can have an individual account
User can belong to 0, 1, or many teams (organization)
User can have team-specific roles (e.g. I'm an Admin in Team1, ReadOnly in Team2). These will be the same for all teams (i.e. Owner, Admin, ReadOnly).
User sees only one context at a time (individual account, Team1, or Team2). Note this also implies we need an easy way to list which teams a user belongs to

Looking at what's available, I'm not sure if Keycloak can support this, and maybe I'll just need to implement my own Teams table in my app DB.

Keycloak Realms - ⚠️ would need to re-login to change Team contexts (AFAIK you can't share users/creds across realms)
Keycloak Groups - ⚠️ Could map teams to Groups, but no way to do Group-specific Roles in Keycloak AFAIK?
Keycloak Roles - ⚠️ Maybe Team+RoleInTeam = Keycloak Role? Not sure if keycloak would handle proliferation of roles well.

I have to think this is a common thing people do. Is Keycloak the right place to try to manage it? Thanks in advance for any input or resources on Keycloak design patterns that might help here.

xgp · 2023-03-02T11:38:37Z

xgp
Mar 2, 2023

Another approach altogether would be to use this extension that adds an Organization model to Keycloak:
https://github.com/p2-inc/keycloak-orgs
https://keycloak.discourse.group/t/keycloak-multi-tenancy-extensions-for-saas-applications/15426
This achieves your first 4 needs, and the 5th (user context) can be achieved with some token mappers that are included in the extension, allowing you to know which organizations and roles the user has.

0 replies

Navigation Menu

Repository navigation

"GitHub Organizations"-style RBAC in Keycloak? #12322

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

"GitHub Organizations"-style RBAC in Keycloak? #12322

Uh oh!

Uh oh!

ross-nordstrom Jun 3, 2022

Replies: 1 comment

Uh oh!

xgp Mar 2, 2023

ross-nordstrom
Jun 3, 2022

xgp
Mar 2, 2023