Dynamic role creation of tenant in the Saas structure

Question

We have Spring Boot projects that we wrote Rest API.We started to actively use aws. We are moving to the Saas structure and we want each client to define their own policy. For example, we have an API with the /getUser endpoint.Some of the tenants can create the "xxx" role. It can request users in the xx role to access this endpoint.Other tenants create the role "yy". It may not want users with this role to access the "getUser" endpoint.Is there a structure where tenants can define roles and manage dynamic these roles in endpoint style? Is there a framework that can solve this issue?I have used keycloack and spring security before. I can't come up with a simple solution using these

Actually, I have a request. Let me authorize tenants using the app. This user can define roles. Let my API endpoints group and create a role. Is there such a structure or what should it be?

Answer 1

You can easily build a custom implementation of the tenant specific roles. The below table shows the management of the tenant specific roles We have unique constraint with RoleName & TenantId so as to allow multiple tenant's to support similar role names

The next table shows the permissions which can be applied to the role which is by tenant.

Note: The data are for illustration, you might have entity and permissions against the entity and the RolePermissions table will have a collection of Identifiers instead of the Permission names.

This kind of system can be expanded with policy builder so that the tenants can build policy around these roles / permissions to govern the access to the application features / endpoints.