Hello All I have a use case for my application where I have Ory Community #talk-keto

Hello All, I have a use case for my application wh...

microscopic-policeman-50029

09/11/2022, 2:10 PM

Hello All, I have a use case for my application where I have multiple roles and multiple features and each role has a different access on a feature, is there a good way to implement it in Keto, which in turns can give me a result that a user with a specific role has access over a feature.

Copy code

features := []string{"f1","f2"}
roles := []string{"r1","r2"}

features /roles r1. r2 f1. {"view","delete"} {"delete","edit"} f2. {"view"} {"delete"}

Copy code

features_role_rights_array := [][][]string{{{"view","delete"},{"delete","edit"}},{{"view"},{"delete"}}}

Now Say a user with id user-1 has a role r2, I want to see over a feature what access does he has? Is there any way to get this information, with implementing it using keto. I have tried this kind of configuration:

Copy code

features:f1#view@(roles:r1#member)
features:f1#delete@(roles:r1#member)

features:f1#delete@(roles:r2#member)
features:f1#edit@(roles:r2#member)

features:f2#view@(roles:r1#member)
features:f2#delete@(roles:r2#member)

roles:r2#member@user-1

Now in order to get my query I am not able to get the details of accesses user-1 has. Is there any way to get this information?

magnificent-energy-493

09/12/2022, 10:29 AM

Did you see our RBAC guide? It uses a few workarounds but could be a good resource for your problem: https://www.ory.sh/docs/keto/guides/rbac Otherwise could you provide some commands for me to reproduce your setup and also include the command that is not working for you - ideally as cURL - that would help a lot to speed this up 🙂 I assume you want to use Check API to get the details of user-1?

microscopic-policeman-50029

09/12/2022, 10:32 AM

Actually I have gone through the RBAC guide but my use case is to get all the access user-1 has, I want to see an output like : user - access list {"delete","edit"} Now if I add the user in roles:r1#member@user-1 as well now I should get the result as user - access list {"view","delete","edit"} I have tried the get relation-tuples api with the details but I am not able to get this kind of a result.

microscopic-policeman-50029

09/12/2022, 10:38 AM

you can run this shell script for setting up the roles in the service:

Copy code

#!/bin/bash
set -euo pipefail

export KETO_WRITE_REMOTE="127.0.0.1:4467"

echo '

features:f1#view@(roles:r1#member)
features:f1#delete@(roles:r1#member)

features:f1#delete@(roles:r2#member)
features:f1#edit@(roles:r2#member)

features:f2#view@(roles:r1#member)
features:f2#delete@(roles:r2#member)

roles:r2#member@user-1

' | \
  keto relation-tuple parse - --format json | \
    keto relation-tuple create - >/dev/null \
    && echo "Successfully created tuples" \
    || echo "Encountered error"

List of Namespaces are; 1. features 2. roles I am able to get the result in the check api i.e. : If user-1 has access to delete feature f1

Copy code

curl --location --request POST 'localhost:4466/relation-tuples/check' \
--header 'Content-Type: application/json' \
--data-raw '{
    "namespace": "features",
    "object": "f1",
    "relation": "delete",
    "subject_id": "user-1"
}'

This curl is giving me true as response but I want all the relations user-1 has in features namespace.

Copy code

curl --location --request GET 'localhost:4466/relation-tuples?namespace=features&object=f1&subject-id=user-1'

Like this api should give me the relations for user-1 with object f1 in namespace features.

3 Views

Open in Slack

Previous Next