search

embesozzi / keycloak-openfga-workshop

Keycloak integration with OpenFGA (based on Zanzibar) for Fine-Grained Authorization at Scale (ReBAC)
https://medium.com/@embesozzi/keycloak-integration-with-openfga-based-on-zanzibar-for-fine-grained-authorization-at-scale-d3376de00f9a
Apache License 2.0
91 stars 26 forks source link

keycloak event listener code not public(?) #1

Closed DGuhr closed 2 years ago

DGuhr commented 2 years ago

Hi Martin,

first of all great work here! I am curious to try it out :) Is it possible that you forgot to open-source the actual Keycloak openfga event listener implementation? The link in the readme leads to a 404, sadly. Maybe I am missing something?

Best regards, Dominik

embesozzi commented 2 years ago

Hi Dominik, Thanks for the feedback :smiley: ! In relation to your question, I still have to deploy keycloak-openfga-event-listener project - I mentioned in the article that this point is pending. Hopefully I will do it soon. Nevertheless, you can run the workshop without any problem. When you build the customized keycloak image, I copy the keycloak-openfga-event-listener-1.0.1.jar inside the keycloak container Dockerfile#L7. So, the custom spi will be available.

Regards, Martin

DGuhr commented 2 years ago

Yeh, I've seen the jar, just curious about the code to dig into it :) no rush, though, didn't catch that in the article :)

I tried it out quickly and all I can say for now is the compose starts up correctly, all is reachable (I get an access denied message after logging in with any of the users at the portal, though, but I guess that's wanted for now) and the openFGA API is actually listening on http://localhost:3000/playground not on http://localhost:3000 as stated in the readme. but these are just nitpicks. Great work, as said, curious how this will evolve and about the event listener doing the transformations :) Feel free to close here.

embesozzi commented 2 years ago

Hi Dominik, The user with the analyst role is able to view the products and the one with the admin role has full rights. I've just added the other use cases, for instance, the use case for publishing products now is available. Anyways, thanks for the feedback. BR,