Event Publisher enables event integration between Keycloak and OpenFGA

mooreds

I posted this because using an authorization server like OpenFGA creates a real issue: syncing authorization related data. There's identity data that needs to be synced (from an identity provider). This seemed like a cool open source solution for that. It's not enough, of course. You also need to sync data between your application/domain and the authorization server to have accurate authorization decisions. But other than using the authorization server's SDK, I don't think there's a general solution to that problem. Disclaimers: I have not used this software. I don't know if it is maintained. I also work for a company that has competitive offerings for both Keycloak and OpenFGA.

gebalamariusz

Overall, it's interesting. OIDC is probably the most common practice for inter-service authentication today. The problem is that in practice, I've seen many configurations where OIDC could be used as an attack vector (missing sub claim condition, which effectively allows any token to assume the role).