[RBAC] :: AD groups : Sync
PBIs
Context
Current implementation of RBAC for groups works via Keycloak's Identity Provider mappers. Any change to group assignments takes affect for each user separately only after session between Keycloak and Entra expires, which can take significant amount of time. Dropping session forcefully could reduce the time, but would cause poor user experience due to frequent re-sign-ins.
Proposed solution
Since latest Keycloak configuration updates we can pre-create users before their first sign-in. This allows importing Entra groups into Keycloak with all members and assigning roles to such groups directly. Role assignments changes will take affect much quicker during next token refreshment (up to 15 mins max).
Diagrams
Celery can be excluded if we decide to provide only manual syncs w/o scheduling
Proof of concept
There is a dockerized PoC using C# and it's libraries for this functionality
Pre-requisites
Target tenant (customer) has granted admin consent to Directory.Read.All, Group.Read.All, User.Read.All. Otherwise MS Graph will respond with 401/403 due to insufficient permissions