Keycloak role based access

can be controlled in Spring Boot in three different locations:

1. Roles Allowed Annotation

Keycloak Role level access can be configured in the controller with the Roles Allowed annotation:

@RolesAllowed("ERM-address")

This can be done on the entire controller, or on an indvidual method within a controller.

2, Security configuration Adapter using antmatcher

Or in the KeycloakWebSecurityConfigurerAdapter

.antMatchers("/erm/*").hasAnyRole("Admin","ERM User")

@Overrideprotected void configure(HttpSecurity http) throws Exception {
   super.configure(http);http
            .authorizeRequests()
            .antMatchers("/erm/*").hasAnyRole("Admin","ERM User")
            .anyRequest()
            .permitAll();http.cors().and().csrf().disable();}

3. Keyclaok configuration in the yml file

security-constraints[1]:
  auth-roles: ERM User
  security-collections[1]:
    name: UiEndpoints
    patterns:
      - /erm/*

All three of the above methods require the application developer to determine what roles have access to what resources.

But we typically want the user to be able to determin what roles have access to what resources.

One solution is to just give each endpoint its role.

ermaddress - get

ermaddress - post

ermaddress put

ermadress Delete

each of the above could have their own role, then the user could give access to each of the endpoint independently, one user could only put, for example.

Then if we have 600 endpoints, the users could have 600 roles. and we could have fine grained permissions.

Another option is we just all or no for the group

EntityAddress_role - can do anything to entity address.

Or even broader access

Entity-role - can do anything with Entity.

But it gets more complicated because we might want to give access to US entities to one person and access only to India entities to another person.

.antMatchers("/erm/*").hasAnyRole("Admin","ERM User") < that path if it contains US then yes or if contains India for the entity then yes

or do we put the permission logic into the endpoint? or do we use a different endpoint for different countries?