[RBAC] :: Frontdoor Django Admin

PBIs

• [RBAC] :: SPIKE :: Research and Document internal user AD group and access for production APIs

Context

Frontdoor Django Admin provides a capability to configure internal data in a convenient way w/o direct T-SQL queries or API Swagger. However, some of the configuration should be visible to a spicific set of people based on team membership. The solution is expected to be

Proposed solution

Empower is using Keycloak as authenticatyion broker for all our clients. Also there is an internal realm empower-shared. To setup the proposed solution it is required to:

• create specific groups in Django Admin with global IDs
• assing permissions for specific set of commands to each of the groups
• create roles in SSO AppReg having values of Django's global IDs
• use empower-shared realm for authentication since it already uses ad_roles that are imported from Entra JWT

After that Django Admin will be rendering only those configurations that are available for current user. The content based on ad_roles claim in JWT from Keycloak, which has the same value as roles claim in Entra JWT.

Adding users to a role will be easy task through existing team groups in Entra (e.g. Devs, QA, DE etc.)

Diagrams

Proof of concept

Link to a directory inempower-playground repo with working PoC. Brief description of that

Pre-requisites

Dependencies of the spike and/or PoC