Keycloak + granular permissions

Getting advice
1

Hello All,

I am having a hard time figuring out how to setup Keycloak to do what I need it to do and, as I have not found any resources online that have been of help on this subject, I am hoping someone in here might be able to steer me in the right direction. It might just be my limited understanding of how resources, policies, permissions, scopes, etc., all work together.

The short version is that I need to be able to programmatically/dynamically create resources, of a pre-defined type, and then assign permissions to a user such that they have one set of permissions on one of those resources and a different set of permissions on a different resource (both of the same type). For example they may have “read” permissions to ResourceA and read/write on ResourceB. I’m not understanding how I can do this with roles, without also dynamically creating roles that mirror the resource, or perhaps assigning the permission directly to the user which seems heavy-handed.

Hopefully that makes sense…

Thank You,

– Chris

2

Hello,
In the API Authorization scenario, there are different approaches for protecting an API. Here are some high-level examples:

  1. Use Keycloak as IdP with OAuth 2.0 and Scopes:
    In this case, the API relies on the scopes defined in the Access Token to determine access control. For example, you can use scopes like “read:document” or “write:document” to specify the level of access. However, keep in mind that these scopes represent the permissions of the application on behalf of the user.

  2. Use Keycloak as IdP with OAuth 2.0 and Identity Claims:
    You can include the user’s Keycloak roles in the JWT (JSON Web Token) or as part of the user info endpoint call to avoid overloading the JWT. Then the API, could use it for doing the policy enforcement. Here is an example demonstrating this approach:

  1. Use Keycloak As Authorization Server with User-Managed Access (UMA):
    In this case, Keycloak acts as the Policy Decision Point (PDP) where you define authorization rules, policies, and resources. Here are some helpful links regarding this approach:

Here are a lot of demo available:

Regards,

2 Likes