Aller au contenu

Keycloak - Caascad roles#

UX customer#

As a customer I want to:

  • provision my users
  • assign caascad roles for my users
  • connect my IDP to Caascad and manage my users there (not done)

Initial setup#

  • a customer realm is provisioned with Caascad customer roles
  • the customer realm is connected as an IDP federation on the zone realm
  • the customer realm is not used if the customer has its own IDP solution (not done)
  • an initial "customer admin user" should be provisioned with an appropriate role (caascad-maintainer) when the cloud is bootstrapped (not done). This admin user will then be able to add more customer users and assign roles to them.
  • the customer admin can log-in on the zone realm using the customer realm

The customer admin user can connect on Keycloak admin interface of the customer realm.

On the console it can:

  • create users/groups and assign them roles
    • caascad roles are already provisioned and documented

Roles#

We can define to types of roles:

  • roles for customers
  • roles for caascad operators (us) / protected

Caascad operator roles#

Theses roles are used by caascad operators and automation tools that provision Caascad's infra.

All caascad operator roles must be prefixed with cscd-.

To simplify things we manage 3 access levels:

  • read-only (no action possible)
  • power-user (most actions possible except IAM or dangerous operations)
  • administrator (all actions possible)

Access can be given per line (prod/staging/...) or by zone.

Customer roles#

Theses roles must have a consistent naming and must be properly described in the customer documentation.

All customer roles must be prefixed with caascad-.

Since a customer might use it's own IDP he will have to provision Caascad roles himself in it's IDP so naming is important.

Static roles#

Theses roles are provisioned during the cloud zone bootstrap.

For example caascad-keycloak-users-admin, caascad-devops.

These are usually roles that give an access level to all clusters in apps.

Dynamic roles#

We want also roles that are restricted to some client cluster. The provisioning of these roles is done when a client zone is bootstrapped.

For example caascad-devops-<clusterName>.

These are roles to give limited access in apps based on the client cluster (concourse teams, rancher cluster...).