Understanding the keycloak authorization over a Resource

[JayanthC]

Hi all,

I’m trying to achieve Resource Based Access Control using the Keycloak Authorization. But I’m having issues in achieving this. I have tried different scenario’s and evaluated the logic but the results are not as expected. Please find the attached document containing screenshots on the implementation of various scenario’s and their results.

Scenario 1:
Have created 2 Users, and for these 2 Users I have created 2 policies one for each and similarly 2 permissions for each as shown below. Here the expectation is that 1 User is owner of the resource (FlowTest) and he has all the permission (Scope: read, modify and execute) and the other user is a USER for this resource and he can only have read permission. But when we evaluate the results doesn’t meet the requirement.

I would greatly appreciate if anyone could try to help me out here. Kindly highlight if my understanding/logic I’m using is incorrect. I would like to know how I can achieve the desired result using keycloak.

Thanks in advance.

[JayanthC]

Scenario 1 evalution Results:

[JayanthC]

Scenario 2:
In this scenario I have tried to acheive the above desired result through group policy. I have created a group with 2 users and created one group policy for this group. Only the read permission is given to the group policy. However, when we evaluate, the members of group are having permission to all 3 scopes.