xgp
commented
1 year ago @Frank-D Thanks for your thorough and thoughtful questions.
Regarding 1, there are no plans to create a hierarchy among organizations. When we originally built this out, organizations was mostly a vehicle to create mutli-IdP, multi-tenancy. In the original prototype we did actually have a concept of multiple, hierarchical "teams" as children to an organization, but we removed it, as there was no demand for it, and we thought it unnecessarily introduced complexity. However, if you think there would be an elegant way to achieve this, we'd listen to a design proposal or review a PR.
Regarding 2, we've talked about it in #25 and #48, but haven't started execution yet. Also, there are some problems with using Keycloak's native groups and roles along with the roles for the organization extension. There were some tradeoffs we had to make based on what is/was available to us when building an extension.
Frank-D
Hi @xgp, following my original interest in this keycloak organization project/extension (ref.) a few months back, I've finally reached a point in my app. development where this multi-tenants support is much needed, and so I've just installed this keycloak extension locally and started playing with it.
Questions:
1- Is there any plan to support multiple [sub]organizations under the same tenant/organization?
Context: No need to be hierarchical, could be as a nice-to-have, but even a simple flat model of 1 org to many [sub] accounts would have been really nice, where a [sub]account could represent a company's division, or department, or team, or it could simply be a user's workspace, where the user is allowed to have a few of those.
Of course, I could assign the user to multiple organizations to model that, but then I loose many benefits of one single organization encapsulation. I suppose allowing an organization to be the child of another organization could have been enough here to allow such hierarchical mapping, but perhaps it is easier said than done, when thinking about the impact of such model on the IDP for instance, but not impossible.
2- Is there any plan to support assigning groups to a user at the "organization level", instead of only roles? (seems to be exactly related to https://github.com/p2-inc/keycloak-orgs/issues/25, but I wanted to circle back on this in case plans may have changed since then, now that such issue is closed..)
Context: In my case, I wanted to leverage the keycloak 'groups' to model my application roles, and the keycloak 'roles' to model my application fine-grained permissions (I've already done so actually, but without any multi-tenant support thus far, reason why I'm here now;) ).
Basically, I was planning to mainly only assign users to groups, and each group is associated to multiple roles, so that by assigning a user to a specific group, the user will automatically inherit the group's associated roles (e.g. app.'s fine-grained permissions), without having to assign each and every single fine-grained permissions to each individual user.
And I was planning to have all tenants support the same list of defined groups by default (e.g. app. roles), and in the event that a specific tenant requires a different set of fine-grained permissions (e.g. keycloak roles) for a given role (e.g. keycloak group), I could always define another unique group that only that tenant would leverage, but in the end, such group will have to be composed of the already existing keycloak roles which are used in the application code (the app. is not checking for the existence of the user groups, but rather the user roles (e.g. app. fine-grained permissions).
Thanks