Add roles based on attribute value (instead of role name) #86

Open

Elektordi wants to merge 2 commits from Elektordi/main into main

Elektordi commented

2023-02-23 15:59:20 -05:00

(Migrated from github.com)

Description

Currently, roles can only be targeted by their name (and the name of their client for client roles), but I have a case on one of the Keycloak I'm working on, where there is a new permissions auditing software, and all users can only be given permissions from there.
All those permissions are coming from an upstream IDP as claims, but we cannot control their names. On the other side, our clients have roles names imposed by different SP.
The only way I found to make it work is by adding a attribute on each role, with the upstream permission name defined here.

I just had to do a little hack, and I'm open to ideas on how to fix it, but 19.0 branch of keycloak have a bug on the UI where you cannot save more than one attribute with the same name, so I split values by commas, to be able to have multiple upstream permissions for a role.

### Description Currently, roles can only be targeted by their name (and the name of their client for client roles), but I have a case on one of the Keycloak I'm working on, where there is a new permissions auditing software, and all users can only be given permissions from there. All those permissions are coming from an upstream IDP as claims, but we cannot control their names. On the other side, our clients have roles names imposed by different SP. The only way I found to make it work is by adding a attribute on each role, with the upstream permission name defined here. I just had to do a little hack, and I'm open to ideas on how to fix it, but 19.0 branch of keycloak have a bug on the UI where you cannot save more than one attribute with the same name, so I split values by commas, to be able to have multiple upstream permissions for a role.

This pull request can be merged automatically.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin Elektordi/main:Elektordi/main

git checkout Elektordi/main

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git checkout main

git merge --no-ff Elektordi/main

git checkout Elektordi/main

git rebase main

git checkout main

git merge --ff-only Elektordi/main

git checkout Elektordi/main

git rebase main

git checkout main

git merge --no-ff Elektordi/main

git checkout main

git merge --squash Elektordi/main