joshburt
commented
1 year ago What?
- Added realm roles a user is assigned to when using the
user listcommand.
Why?
- We've had a client request for additional user level control. Specifically the ability to expose and operate on a user's roles.
How?
- It doesn't look that we currently have any method to access this data. I was able to find the related KeyCloak API documentation for this however:
From https://www.keycloak.org/docs-api/12.0/rest-api/#_userrepresentation
Get realm-level role mappings: GET /{realm}/groups/{id}/role-mappings/realm
- I saw two ways to approach this. Let me know if there are better/other solutions given performance considerations.
Option 1 (Current implementation)
- Get user roles on a per-user basis. This is noisy! :/ I have to request additional user data on a per-user level. So
ncalls fornusers.
Option 2 (Alternative)
- Get all roles, and correlate user assignment with the user list.
- I would need to see if can make a get a role list, and then request each role's assignments. Then correlate this to the user list. I think we could get this down to
1 + ngroup calls plus some local processing.
If there are a lot of users optional 1 will be slow. If there are a lot of roles then option 2 will be slow. There might also be different endpoints which provide all the user or role level information in a single call. I'm new to KeyCloak so this could easily be the case. :)
How was this tested?
- Unit tests added
Possible Discussion Points
- [ ] KeyCloak User<->Role Mapping Thoughts
- [ ] Column name. It's currently
realm_roles. It looks like internally there might also be other role types as well as groups. If/when we expose these I didn't want to have overlap. Please let me know if you have any suggestions on naming.
Copyright date, repo url, and additional ignores for macos and anaconda-project