You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Description
ldap security today requires that the application has identical names for ldap groups and application roles. But this is not realistic. most orgs have a naming convention for ldap objects, which will clash with java group names.
Implementation ideas
Elytron has the required possibilities, they need to be made accessible from quarkus. You have to decide if this is ldap-only or general. Code goes more or less like this:
Adapt the class:
In io.quarkus.elytron.security.runtime.ElytronRecorder # configureDomainBuilder:
Map<String, Set<String>> roleMap = new HashMap<>();
for each GROUP & ROLE from the config:
roleMap.put(GROUP, new HashSet<>(Arrays.asList(ROLE.trim().split(" *, *"))));
<the realm builder, just after the call to setRoleDecoder>
.setRoleMapper(MappedRoleMapper.builder().setRoleMap(roleMap).build());
The text was updated successfully, but these errors were encountered:
Of course the mappings from groups to roles should be adjustable at runtime. But the usage of the role mapper itself should be fixed at buildtime or at runtime?
The role mapper is defined in the elytron security domain (as you already wrote). The role mapper would also apply to other security-realms. So please rename the issue to: elytron security: define role mapper
Concerning:
But the usage of the role mapper itself should be fixed at buildtime or at runtime?
For us it doesn't matter. Some conflicting concerns, feel free to choose whichever you like ;-)
dev and prod security may be drastically different, managed by different people with access to different security systems. An Infosec team might decide on the fly to change the rules. Hence, all security settings (not only the role mapper) should be runtime properties. -> Runtime
As this is part of the LDAP story, do the same as the other LDAP parts -> Buildtime
You want your config on dev to match the one on prod as close as possible, hence force usage of the same code paths -> Buildtime
Description
ldap security today requires that the application has identical names for ldap groups and application roles. But this is not realistic. most orgs have a naming convention for ldap objects, which will clash with java group names.
Implementation ideas
Elytron has the required possibilities, they need to be made accessible from quarkus. You have to decide if this is ldap-only or general. Code goes more or less like this:
Adapt the class:
I assume a config more or less like this:
Add something like:
The text was updated successfully, but these errors were encountered: