Content Comparison

...

Overview

mod-roles-keycloak is a Spring-based module responsible for the following functionality:

...

API-Documentation: https://s3.amazonaws.com/foliodocs/api/mod-roles-keycloak/s/mod-roles-keycloak.html

Functionality

Role management

mod-roles-keycloak allows role management:

1. A user can view, create, edit, and delete roles

2. A user can assign and unassign roles to/from a user

Policy management

mod-roles-keycloak allows policy management:

...

Capability and capability sets

mod-roles-keycloak receives events with permission data from mgr-tenant-entitlements and transforms permission data into capabilities and capability sets:

Permission-Capability/CapabilitySet mapping algorithm

Reference roles (Loadable roles)

mod-roles-keycloak can store pre-defined roles as reference data and be populated through the Tenant Entitlement process.

...

{
  "roles": [
    {
      "name": "{{role name}}",
      "description": "{{role description}}",
      "permissions": [
        // list with Folio permission name
      ]
    }
  ]
}

Reference data policies

mod-roles-keycloak can create a policy from reference data.

...

{
  "policies": [
    {
      "id": "15f45670-1edf-441e-a247-51f6c000faa3",
      "name": "Business Hours",
      "type": "TIME",
      "source": "USER",
      "timePolicy": {
        "start": "2023-07-01T00:00:00",
        "expires": "2033-07-01T00:00:00",
        "logic": "POSITIVE",
        "monthStart": "1",
        "monthEnd": "12",
        "hourStart": "8",
        "hourEnd": "20"
      }
    }
  ]
}

Permission migration

mod-roles-keycloak provides an API to migrate existing user permissions from mod-permissions and assign them to newly created roles with unique names, based on SHA1 hash from all contained permissions to this role.

Algorithm is described at User permissions migration.

Core models and entities

Role

A role in Keycloak is a fundamental building block used for access control and authorization within the Keycloak identity and access management system. Roles define a set of permissions or capabilities that can be assigned to users or groups to regulate their access to resources and functionalities within an application or system. By assigning roles, administrators can manage user permissions in a scalable and organized manner, ensuring that users have the appropriate level of access required to perform their duties while maintaining security and compliance.

User-Role

Describes a relation between user and role.

Policy

A policy in Keycloak is a set of rules and conditions used to determine whether a user or group is authorized to access a particular resource or perform a specific action within an application or system. Policies are key to Keycloak's authorization services, enabling fine-grained access control by evaluating attributes, roles, and other contextual information to make dynamic access decisions. By defining policies, administrators can implement complex access control mechanisms beyond simple role-based access control (RBAC), incorporating attributes and environmental conditions into the authorization process.

Capability

A capability represents a specific functionality or access right within a system that allows users to perform certain actions or access particular resources. Capabilities are derived from permissions in the module descriptor, which define the rights required to execute a given functionality. By encapsulating permissions into capabilities, systems can manage and control user access more effectively, ensuring that only authorized users can perform sensitive operations or access restricted data.

...

Capability Set

A CapabilitySet is a collection of related capabilities grouped to define a broader range of functionalities or access rights within a system. By uniting multiple capabilities into a single set, a CapabilitySet allows for more efficient and organized user permissions management, making assigning and controlling access based on roles, tasks, or specific use cases easier. This approach simplifies the process of granting users the necessary rights to perform various related actions without having to manage each capability individually.

...

Role-Capability

...

Role-CapabilitySet

...

User-Capability

...

# mod-roles-keycloak
Capability("{{capabilityId}}", "foo.item.view", "/foo/item/{id}")
User("{{userId}}")
create UserCapability("{{userId}}", "{{capabilityId}}")

# keycloak (client = {{tenant}}-application)
GET access for user'{{userId}}' to '/foo/item/{id}'

User-CapabilitySet

...

Loadable Role

Loadable roles and loadable permissions are created from reference data, that stored in mod-roles-keycloak repository: https://github.com/folio-org/mod-roles-keycloak/tree/master/src/main/resources/reference-data/roles

...

Loadable Permission