Repository navigation
Replies: 1 comment
|
If you want upwards aggregation, it can be achieved with composite roles alongside your groups:
|
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Proposal
Assume we have the following group hierarchy parent_group / child_group, where both groups have the attribute X. Currently a user belonging to child_group can have a claim in the token containing both values of attribute X in the form of a comma separated string.
It would be useful to add an option to the mapper so that users belonging to parent_group would have in their token claim all the values for attribute X that come from their children.
Rationale
Sometimes being member of a group means that you have some common characteristics, implemented in keycloak with the user/group attributes and in these cases the downwards aggregation of the attributes makes sense.
However there are cases where an attribute indicates a permission you have and parent users have all the permissions of their children. In these cases an upwards aggregation of the attribute's value would make more sense.
Example
Company A has Division A and Department A in the following hierarchy: Company A / Division A / Department A. Members of a division can unlock all the doors of the departments that belong to it. If we want a token claim containing the doors a user can unlock, there is no way to do it other than adding the user to all the departments of the division.
Note
An extra option could be added for "No group aggregation" for cases were that would be useful. With the implementation of only this option, workarounds could be used for materializing the scenario in the example
All reactions