KEYCLOAK-11300 : Creating CustomEnforcer functionality for spring adapters #6448

sushil-singh-guavus · 2019-11-05T20:36:06Z

KEYCLOAK-11300 : Creating CustomEnforcer functionality for spring adapters

https://issues.jboss.org/browse/KEYCLOAK-11300

stianst · 2019-11-08T07:10:14Z

Hi, thanks for your PR. Can you please open a discussion around this on the dev ML?

sushil-singh-guavus · 2019-11-08T07:13:14Z

Hi , Actually I am already in discussion with Pedro Igor Silva . Do i need to open another dicussion ?

________________________________ From: Stian Thorgersen <notifications@github.com> Sent: 08 November 2019 12:40 To: keycloak/keycloak <keycloak@noreply.github.com> Cc: Sushil Singh <sushil.singh@guavus.com>; Author <author@noreply.github.com> Subject: Re: [keycloak/keycloak] KEYCLOAK-11300 : Creating CustomEnforcer functionality for spring adapters (#6448) Hi, thanks for your PR. Can you please open a discussion around this on the dev ML? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub<#6448?email_source=notifications&email_token=AL2BDR656Z5VT6BL7LCYBDLQSUGGTA5CNFSM4JJIPMAKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEDO6I5Y#issuecomment-551412855>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AL2BDR22SMNZ6JUWO5MBLHLQSUGGTANCNFSM4JJIPMAA>.

stianst · 2019-11-08T07:42:38Z

Where? It would be good to have the discussion openly on the dev ML.

sushil-singh-guavus · 2019-11-08T08:12:24Z

Where? It would be good to have the discussion openly on the dev ML.

Actually it is going on mail
@stianst, i have re-initiated the discussion

pedroigor · 2019-11-08T13:35:20Z

Where? It would be good to have the discussion openly on the dev ML.

@stianst the JIRA provides some background and a document with more details about what @sushil-singh-guavus is proposing.

I asked him to send the PR so that we could understand better the use-case and start discussing the changes.

pedroigor

@sushil-singh-guavus, now that we have the code and based on the description you have in the doc (attached to the JIRA), the intent is much more clear.

Correct me if I'm wrong, please. The objective here can be summarized as follows:

As a user I want to programmatically check whether or not a request is authorized to access a protected resource, so that I can pass the resource identifier/name and/or the set of scopes
As a user I want to be able to programmatically manage resources (CRUD) so that I can manage the resources that should be protected by Keycloak

If my assumption is correct, I think we can solve that differently by leveraging the AuthorizationContext class, which is available from the KeycloakSecurityContext that is usually available in the request scope.

The AuthorizationContext already provides methods for checking permissions, but today, they rely on any permissions carried by the token and do not interact with the server if no permission (for a resource/scope) is available.

It seems to me that we can simplify this implementation while addressing the same requirements.

In fact, recently, we have implemented a policy enforcer for Quarkus`which provides a similar approach to check permissions programmatically. While it also does not interact with the server to query for permissions, the hook is there to adapt and enhance programmatic authorization.

Please, let me know your thoughts about what I said.

sushil-singh-guavus · 2019-11-09T10:43:04Z

@sushil-singh-guavus, now that we have the code and based on the description you have in the doc (attached to the JIRA), the intent is much more clear.

Correct me if I'm wrong, please. The objective here can be summarized as follows:

As a user I want to programmatically check whether or not a request is authorized to access a protected resource, so that I can pass the resource identifier/name and/or the set of scopes

As a user I want to be able to programmatically manage resources (CRUD) so that I can manage the resources that should be protected by Keycloak

If my assumption is correct, I think we can solve that differently by leveraging the AuthorizationContext class, which is available from the KeycloakSecurityContext that is usually available in the request scope.

The AuthorizationContext already provides methods for checking permissions, but today, they rely on any permissions carried by the token and do not interact with the server if no permission (for a resource/scope) is available.

It seems to me that we can simplify this implementation while addressing the same requirements.

In fact, recently, we have implemented a policy enforcer for Quarkus`which provides a similar approach to check permissions programmatically. While it also does not interact with the server to query for permissions, the hook is there to adapt and enhance programmatic authorization.

Please, let me know your thoughts about what I said.

@pedroigor Based on my understanding , When it comes to AuthorizationContext , it has methods to check permission for resource and a scope. So even if we extend it's functionalities for eg-: [Resource , Set of Scopes] , it won't be able to provide UMA and other functionalities that the policy-enforcer provides as it directly work on tokens

In our case client may not know the permission to be able to access that resource and scope. So firstly it will just call with an access token and based on the permission ticket , it will bring out the RPT

We have seen most of the options and then decided that policy-enforcer functionalities is what we are looking for , but some what in a custom fashion

Following things are there in PolicyEnforcer flow and needed for us

UMA i.e permission ticket flow working for us
Caching of resources
Lazy Loading (on demand resource)
wildcard resource matching

So, that's why I created CustomEnforcer functionality which can be enabled using keycloak.json. And you just specify the map of <resource , Set programatically. and just call the custom enforcer function. It will authenticate , authorize and set the applicable response status.

Here I am using PolicyEnforcer caching , wildcardresource matching , Lazy loading and have customized UMA flow based on "Map<Resource, Set of scopes>"

So , I am afraid that extending functionality of AuthorizationContext won't work for us.

I hope things are clear from my side , and also i will request to correct me if I am wrong somewhere

stianst · 2019-11-11T12:46:49Z

Didn't see any email about this on the dev ML yet. Could you please open a thread there so others can participate if they want to?

sushil-singh-guavus · 2019-11-11T12:51:15Z

Can you tell the mail ID of dev mailing list. I have mailed on keycloak-users but don't know the dev mail id Get Outlook for Android<https://aka.ms/ghei36>

…

________________________________ From: Stian Thorgersen <notifications@github.com> Sent: Monday, November 11, 2019 6:17:02 PM To: keycloak/keycloak <keycloak@noreply.github.com> Cc: Sushil Singh <sushil.singh@guavus.com>; Mention <mention@noreply.github.com> Subject: Re: [keycloak/keycloak] KEYCLOAK-11300 : Creating CustomEnforcer functionality for spring adapters (#6448) Didn't see any email about this on the dev ML yet. Could you please open a thread there so others can participate if they want to? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<#6448?email_source=notifications&email_token=AL2BDR5RF336WSMWBWQS6ETQTFH4NA5CNFSM4JJIPMAKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEDWXB6A#issuecomment-552431864>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AL2BDRZRZ4MNFTSUJN6MSJLQTFH4NANCNFSM4JJIPMAA>.

stianst · 2019-11-13T09:16:07Z

@sushil-singh-guavus check out https://www.keycloak.org/community for details on ML. @pedroigor started a thread on this there, so let's continue the discussion on the ML

sushil-singh-guavus · 2020-02-04T10:30:14Z

@stianst @pedroigor , It's been pending for a lot of days .

I have created a quickstart

https://github.com/sushil-singh-guavus/keycloak-quickstarts/tree/keycloak-11300-quickstarts
https://github.com/sushil-singh-guavus/keycloak/tree/keycloak-11300

Can you check !!

stianst · 2020-06-15T11:14:15Z

Was a discussion opened on the dev mailing list around this? If so what was the conclusion here? From my perspective this may seem a bit to complex and seems like something we may not want to consider. @pedroigor wdyt?

pedroigor · 2020-06-16T19:56:54Z

@stianst We had some discussion, can't find now the thread. But we ended up with this PR.

@sushil-singh-guavus After looking at your quickstart, I think I see now what you really want. And I still think we can do something along the lines with what I mentioned before.

It seems that we could just change the AuthorizationContext so that you can call specific methods to directly invoke the server. It should require fewer changes.

Pretty much what you have here https://github.com/sushil-singh-guavus/keycloak/commits/keycloak-11300? I'm not sure whether or not the changes herein are really needed by those from your branch.

sushil-singh-guavus · 2020-06-17T08:41:34Z

@pedroigor , I am fine with the changes suggested by you that i have modified a bit because some things were breaking in https://github.com/sushil-singh-guavus/keycloak/commits/keycloak-11300

pedroigor · 2020-06-18T14:01:55Z

@sushil-singh-guavus I see, so I think we should just have this PR with the changes you have in https://github.com/sushil-singh-guavus/keycloak/commits/keycloak-11300 plus the additional method and related changes to the AuthorizationContext so that you can pass that map with permissions.

Makes sense ? It should be much simpler, I think.

sushil-singh-guavus · 2020-06-19T07:20:40Z

@pedroigor right !!

Hi pedro, Correct me If I am wrong but I think changes related to passing map as a parameter is there in https://github.com/sushil-singh-guavus/keycloak/commits/keycloak-11300

I have also demonstrated that in quickstart also how we can use that

Let me put it here also,

AuthorizationContext authzContext = keycloakSecurityContext.getAuthorizationContext();
AdapterAuthorizationContext clientContext = AdapterAuthorizationContext.class.cast(authzContext);
Map<String, Set> permissionMap = new HashMap();
Set scopes = new HashSet();
scopes.add("CREATE");
String namespace = piplineData.getNamespace();
String name = piplineData.getName();
Object resource = new Object();
permissionMap.put(namespace,scopes);
clientContext.authorize(permissionMap);

pedroigor · 2020-06-19T14:13:30Z

Yeah, so we should just change this PR to have that instead of all the changes herein ...

sushil-singh-guavus · 2020-06-19T16:54:26Z

Yeah, so we should just change this PR to have that instead of all the changes herein ...

This PR was created from https://github.com/sushil-singh-guavus/keycloak/tree/feature/custom-policy-enforcer
Should i create new PR with https://github.com/sushil-singh-guavus/keycloak/commits/keycloak-11300
or
Should i revert the changes in this feature/custom-policy-enforcer branch and commit changes from branch keycloak-11300 in to it

plzz suggest

pedroigor · 2020-06-19T17:18:51Z

Changes from keycloak-11300. They are enough, right?

sushil-singh-guavus · 2020-06-20T12:59:04Z

Changes from keycloak-11300. They are enough, right?

yes correct all changes are there in https://github.com/sushil-singh-guavus/keycloak/commits/keycloak-11300 ,

I just want to know what needs to be changed from my side in this PR

pedroigor · 2021-09-30T11:34:11Z

It has been a while and plans have changed. We are avoiding drastic changes to this area of Keycloak.

Sorry and thanks for your contribution.

CustomEnforcer functionality

4614b13

sushil-singh-guavus changed the title ~~CustomEnforcer functionality~~ KEYCLOAK-11300 : Creating CustomEnforcer functionality for spring adapters Nov 6, 2019

pedroigor self-requested a review November 6, 2019 15:52

stianst added Discuss missing/docs Documentation is missing missing/tests Tests are missing labels Nov 8, 2019

pedroigor reviewed Nov 8, 2019

View reviewed changes

stianst assigned pedroigor Nov 22, 2019

stianst added this to the 10.0.0 milestone Mar 17, 2020

stianst modified the milestones: 10.0.0, 11.0.0 Apr 21, 2020

stianst added status/needs-discussion PR needs discussion on developer mailing list and removed Discuss labels Jun 16, 2020

pedroigor added the area/authorization-services Indicates an issue on Authorization area label Jun 16, 2020

pedroigor added kind/enhancement Categorizes a PR related to an enhancement kind/feature Categorizes a PR related to a new feature labels Jun 18, 2020

pedroigor removed the kind/feature Categorizes a PR related to a new feature label Jun 18, 2020

abstractj requested a review from pedroigor July 2, 2020 19:32

pedroigor closed this Sep 30, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

KEYCLOAK-11300 : Creating CustomEnforcer functionality for spring adapters #6448

KEYCLOAK-11300 : Creating CustomEnforcer functionality for spring adapters #6448

sushil-singh-guavus commented Nov 5, 2019

stianst commented Nov 8, 2019

sushil-singh-guavus commented Nov 8, 2019 via email •

edited

Loading

stianst commented Nov 8, 2019

sushil-singh-guavus commented Nov 8, 2019 •

edited

Loading

pedroigor commented Nov 8, 2019

pedroigor left a comment •

edited

Loading

sushil-singh-guavus commented Nov 9, 2019 •

edited

Loading

stianst commented Nov 11, 2019

sushil-singh-guavus commented Nov 11, 2019 via email

stianst commented Nov 13, 2019

sushil-singh-guavus commented Feb 4, 2020

stianst commented Jun 15, 2020

pedroigor commented Jun 16, 2020 •

edited

Loading

sushil-singh-guavus commented Jun 17, 2020

pedroigor commented Jun 18, 2020

sushil-singh-guavus commented Jun 19, 2020 •

edited

Loading

pedroigor commented Jun 19, 2020

sushil-singh-guavus commented Jun 19, 2020

pedroigor commented Jun 19, 2020

sushil-singh-guavus commented Jun 20, 2020 •

edited

Loading

pedroigor commented Sep 30, 2021

KEYCLOAK-11300 : Creating CustomEnforcer functionality for spring adapters #6448

KEYCLOAK-11300 : Creating CustomEnforcer functionality for spring adapters #6448

Conversation

sushil-singh-guavus commented Nov 5, 2019

stianst commented Nov 8, 2019

sushil-singh-guavus commented Nov 8, 2019 via email • edited Loading

stianst commented Nov 8, 2019

sushil-singh-guavus commented Nov 8, 2019 • edited Loading

pedroigor commented Nov 8, 2019

pedroigor left a comment • edited Loading

Choose a reason for hiding this comment

sushil-singh-guavus commented Nov 9, 2019 • edited Loading

stianst commented Nov 11, 2019

sushil-singh-guavus commented Nov 11, 2019 via email

stianst commented Nov 13, 2019

sushil-singh-guavus commented Feb 4, 2020

stianst commented Jun 15, 2020

pedroigor commented Jun 16, 2020 • edited Loading

sushil-singh-guavus commented Jun 17, 2020

pedroigor commented Jun 18, 2020

sushil-singh-guavus commented Jun 19, 2020 • edited Loading

pedroigor commented Jun 19, 2020

sushil-singh-guavus commented Jun 19, 2020

pedroigor commented Jun 19, 2020

sushil-singh-guavus commented Jun 20, 2020 • edited Loading

pedroigor commented Sep 30, 2021

sushil-singh-guavus commented Nov 8, 2019 via email •

edited

Loading

sushil-singh-guavus commented Nov 8, 2019 •

edited

Loading

pedroigor left a comment •

edited

Loading

sushil-singh-guavus commented Nov 9, 2019 •

edited

Loading

pedroigor commented Jun 16, 2020 •

edited

Loading

sushil-singh-guavus commented Jun 19, 2020 •

edited

Loading

sushil-singh-guavus commented Jun 20, 2020 •

edited

Loading