How to set a keycloak role for a user created in keycloak

[coolbung]

SB RC allows creation of Keycloak users by adding enableLogin:true to a schema.
How can we additionally set roles for such a user when the user is added to Keycloak.

Eg: I have a Teacher entity defined in SB RC and when a user is created in keycloak I wish to attach the attendance-management role to this keycloak user.

@dileepbapat @kesavanp123 is this doable with current config or will need enhancement ? Since I cannot see in the docs - https://docs.sunbirdrc.dev/use/schema-configuration

cc @rahul101001000

[dileepbapat]

@coolbung What is the intent of the role, if it is going to get assigned to selected teachers then can it be managed outside registry ?

[coolbung]

Role is to ensure only teachers are able to create attendance records. There would be other entities in the system (eg: students) who should not have the access to create attendance records. All teachers will need to have the attendance-management role.

[gamemaker1]

If AttendanceRecord is another entity, you can enforce the type of entity that can create a new type of entity in the registry (i.e.: only a Teacher entity can create a AttendanceRecord entity), by setting the roles and inviteRoles fields in _osConfig.

[pramodkvarma]

Some of these can be done at app layer too. It is important to allow apps built on top to create their own roles, flows, processes, etc without trying to everything via framework. Regards, Pramod. twitter.com/pramodkvarma linkedin.com/in/pramodkvarma sent from mobile. please excuse typos

…

On Mon, Dec 20, 2021, 4:58 PM Ashwin Date ***@***.***> wrote: Role is to ensure only teachers are able to create attendance records. There would be other entities in the system (eg: students) who should not have the access to create attendance records. All teachers will need to have the attendance-management role. — Reply to this email directly, view it on GitHub <#178 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA3KJTUXWVP2JPTDW5QA2H3UR4HNNANCNFSM5KNNEZQQ> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.*** com>

[tejash-jl]

@coolbung we create a group in keycloak by the same entity name when the user is created. You can assign the roles required for that entity to that group in keycloak.

[coolbung]

This sounds good. Please note @pawana