Namespaced Roles #8516

dgozalo · 2021-09-30T16:54:21Z

dgozalo
Sep 30, 2021

The proposal draft 1 can be found in: keycloak/keycloak-community#318 as it was too large for Github Discussions.

Changes can be proposed in there but discussion is encouraged to happen here.

pedroigor · 2021-09-30T19:40:48Z

pedroigor
Sep 30, 2021
Collaborator

@dgozalo Indeed, more flexible and certainly unlocks additional use cases. A few questions:

If I understood correctly, it should not introduce much overhead on the storage level because the format makes it very easy to query/identify a role and its level. Mainly when deleting entities that are part of the format. We should probably consider a more smart cache for quickly querying roles at different levels.
UI-wise, perhaps the UI could avoid trees and just show roles "sectioned" by level. I don't know, our UX team should know what is the best. But trees mean hierarchy and, like clients, other future fixed parts (as per the extensibility section) might not fit too.
W.r.t. dynamic scopes and RAR, I'm not sure if it solves the main problem because the main requirements there are related to scopes dynamically created and consent (open banking). I understand it helps to dynamically choose the roles based on a well-defined format for requesting scopes, but not yet an answer about how clients can create/reference new scopes and how users should consent. Perhaps this is more related to "Dynamic Role Mapping" or something else. RAR is definitely beyond the scope here, IMO.
Does it mean we are finally deprecating composite roles? Composite roles also provide a hierarchy but are solely based on roles. I don't see here how the namespaced roles can be used for the same purpose.

Btw, are we then considering supporting a single-realm multi-tenancy model rather than a multi-realm tenant model?

1 reply

dgozalo Oct 1, 2021
Author

Thanks for going through the proposal and coming up with great questions @pedroigor, let me go through them:

That's it. By adding the namespace field in the database with the full id/path, it should both keep retrocompatibility with existing roles and not add extra overhead to existing queries. When it comes to storage layers, that's where my understand is still a bit limited, so I trust the judgement of all of you more experienced with the codebase :).
That's the one where I'm torn a bit. Clients should be part of the hierarchy as roles can be created for certain clients too, but it doesn't fit nicely in a hierarchical representation that this is supposed to create. We can consider a different representation in the UI for sure, or try to think how we could involve clients without putting them in the role path.
So for Dynamic Scopes and RAR, there will be a joint proposal to implement them in Keycloak, it will be completely separate from this one. What I tried to surface in this one is that, by having a way to scope the authentication to a certain context, we could use this new roles format to more easily query at the context that we are scoping by. So, yes, this is just a very small nice-to-have for Dynamic Scopes and RAR to make them more powerful when filtering roles.
Afaik, composite roles are used to "group" roles together under a single role. So you can just assign a single role to a subject and that subject will also get all the roles associated with it. In my view, namespaced roles could also be composed by others, but we'd need to set some boundaries. For example: If your role is scoped to a certain tenant or group, the roles that compose it will also need to be scoped to that specific context. But we can do some more research on this area.

The multitenancy model is still WIP but I believe the former is the prevailing choice for now, yes.

dgozalo · 2021-10-07T20:24:46Z

dgozalo
Oct 7, 2021
Author

The PR has been updated with some changes to the namespaces format and added a few more use cases.

0 replies

Navigation Menu

Repository navigation

Namespaced Roles #8516

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 2 comments 1 reply

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh! 8000

Select a reply

Uh oh!

Namespaced Roles #8516

Uh oh!

Uh oh!

dgozalo Sep 30, 2021

Replies: 2 comments · 1 reply

Uh oh!

Uh oh!

pedroigor Sep 30, 2021 Collaborator

Uh oh!

dgozalo Oct 1, 2021 Author

Uh oh!

dgozalo Oct 7, 2021 Author

dgozalo
Sep 30, 2021

Replies: 2 comments 1 reply

pedroigor
Sep 30, 2021
Collaborator

dgozalo Oct 1, 2021
Author

dgozalo
Oct 7, 2021
Author