Manage Multitenancy with Users Logging in via Keycloak

[TonySondaggi]

Summary

Implement multitenancy management for users logging in via Keycloak. Currently, Directus already retrieves the list of Keycloak groups from the JWT token, reads them, and based on the environment variable AUTH_KEYCLOAK_ROLE_MAPPING, it selects the first matching role ID and assigns that role to the user.

The system should allow multiple roles to be assigned to a user in this way (e.g., if two groups match two role IDs, both roles should be assigned to the user). Each role must have specific permissions to manage/view various collections and schemas.

Basic Example

No response

Motivation

Native multitenancy management in this way would make Directus an excellent candidate for project use cases requiring SSO (and non-SSO) access for multiple users who need cumulative and dynamically assigned permissions.

Detailed Design

The user should have a list of assignable roles instead of a single role. The permissions derived from this should be additive, not subtractive (if a user can perform an action with at least one assigned role, they should still be able to perform it; if the action is restricted for all assigned roles, then the user should not be able to perform it). Even when logging in via Keycloak, every role that matches a Keycloak group should be added to the user.

Requirements List

Must Have:

• A list of roles assignable to the user, both manually and through Keycloak login.

Drawbacks

While having a list of roles on a single user would allow native multitenancy management, this change could lead to permission inconsistencies when they are accumulated in the case of users with multiple roles.

Alternatives

An alternative approach could be to integrate multitenancy management that does not take roles into account, by creating Tenants that contain the associated collections and schemas, and making them assignable to users.

Adoption Strategy

If we implement this proposal, existing Directus developers would need to modify their user role management logic to accommodate multiple roles per user manually or via Keycloak integration. This is not a breaking change but may require some adjustments of existing configurations and workflows, especially in projects based on single role assignments.

We can implement a migration to handle the process of migrating users from the current model (single role) to the new model (multiple roles). This will involve changing the database schema to support multiple roles for every user and ensuring that existing roles are migrated correctly.

This transition will impact other projects within the Directus environment, namely those that utilize custom role-based permissions. Developers will need to review their current implementations and modify their permission management to consider the additive nature of the new role system. The modification is intended to add flexibility without breaking existing functionality.

Unresolved Questions

No response