Keycloak - Caascad roles#
UX customer#
As a customer I want to:
- provision my users
- assign caascad roles for my users
- connect my IDP to Caascad and manage my users there (not done)
Initial setup#
- a customer realm is provisioned with Caascad customer roles
- the customer realm is connected as an IDP federation on the zone realm
- the customer realm is not used if the customer has its own IDP solution (not done)
- an initial "customer admin user" should be provisioned with an appropriate role (
caascad-maintainer) when the cloud is bootstrapped (not done). This admin user will then be able to add more customer users and assign roles to them. - the customer admin can log-in on the zone realm using the customer realm
The customer admin user can connect on Keycloak admin interface of the customer realm.
On the console it can:
- create users/groups and assign them roles
- caascad roles are already provisioned and documented
Roles#
We can define to types of roles:
- roles for customers
- roles for caascad operators (us) / protected
Caascad operator roles#
Theses roles are used by caascad operators and automation tools that provision Caascad's infra.
All caascad operator roles must be prefixed with cscd-.
To simplify things we manage 3 access levels:
- read-only (no action possible)
- power-user (most actions possible except IAM or dangerous operations)
- administrator (all actions possible)
Access can be given per line (prod/staging/...) or by zone.
Customer roles#
Theses roles must have a consistent naming and must be properly described in the customer documentation.
All customer roles must be prefixed with caascad-.
Since a customer might use it's own IDP he will have to provision Caascad roles himself in it's IDP so naming is important.
Static roles#
Theses roles are provisioned during the cloud zone bootstrap.
For example caascad-keycloak-users-admin, caascad-devops.
These are usually roles that give an access level to all clusters in apps.
Dynamic roles#
We want also roles that are restricted to some client cluster. The provisioning of these roles is done when a client zone is bootstrapped.
For example caascad-devops-<clusterName>.
These are roles to give limited access in apps based on the client cluster (concourse teams, rancher cluster...).