Vfrdtyky

im using Spring Boot 2 and Keycloak (keycloak-spring-boot-starter) to implement a REST API. However, I just can't get it right.

My API resources look like this:

POST /api/a to create a, if granted a:write

GET /api/a to read all granted with a:read

GET /api/a/{name} to read a single a (if granted with a:read)

POST /api/a/{name}/b to create b under a, if granted b:write
and so on...

Every API resource should also get a ResourceRepresentation in Keycloak, as the requirement is to give read access on a per-resource base to users. I am planning on using groups for this and assigning users to groups that match the name of the resource. (e.g. resource name will be /a1/b1, which will also be a group to which i assign users with read access)

Write permissions will only be granted to admins, which will be in a group assigned with a role accordingly.

I've been trying all week, to no success. Both my API implementation and Keycloak configuration look like a battlefield. The example on github is way too simplistic, as it doesn't show nested resources and the correlation between HTTP methods and scopes.

How would you structure

1. Your Keycloak server (i.e. the client config: resources (includings URIs), scopes, policies, permissions; as well as: groups, roles)?


2. Your Spring Boot 2 application.properties (to work with Keycloak Authz)?


3. Is the following statement true: If I get my API set up right (mapping paths and methods to scopes), i can completely control access to my resources via Keycloak users, groups, roles, policies and permissions.


4. Can the policy-enforcer-config be mixed? Meaning one part from the application.properties, the other from the Keycloak server? Will it merge all possible paths? How will paths be resolved?

Conceptually, i had to make a distinction between single resources and list resources:

/buildings/building-1              associated with scopes building:read, building:write, roomS:read, roomS:write

/buildings/building-1/rooms        requires the roomS:read or roomS:write respectively

/buildings/building-1/rooms/room-1 associated with scopes room:read, room:write

Note the plural in the scopes for the /rooms resource.

Also, mixed policy-enforcer-config between application.properties and the Keycloak server works: endpoints are mapped to scopes in application.properties and concrete resource paths are managed by the Keycloak server.

Hope this helps someone else!

Here is the configuration to enforce the scope based permission -

keycloak.policy-enforcer-config.paths[1].path=/api/resourcea
keycloak.policy-enforcer-config.paths[1].scopes=profile:view,album:delete