title: How should I set up authorization for a "role-less" (ACL, ABAC) REST API with Keycloak?
body: <p>My reasoning is based on the premise that when it comes to security, one should not reinvent the wheel and is better off studying which of the available solutions fits best.</p>
  
  <p>Suppose you have an application that lets users create <strong><em>things</em></strong> and allow their friends to change them in some way.
  I imagine that using a role-based approach would not work well in this situation and that something like an access control list for each thing is closer to ideal.</p>
  
  <p>Following the premise I presented in the first paragraph, I studied Keycloak's documentation in search of something akin to ACLs, as I'll also need an authentication mechanism. I could not come up with a solution that didn't feel "hacky", to say the least...</p>
  
  <p>Instead of writing an exhaustive list of what I thought of, I'd like to ask:</p>
  
  <ul>
  <li>Is my reasoning correct?</li>
  <li>Is Keycloak really what I'm looking for or I should use it in tandem with something like casbin?</li>
  <li>How would you solve this?</li>
  </ul>
  
  <p>Thanks!</p>
  
  <p><strong>Edit</strong> (14/05/20)</p>
  
  <p>To further discuss this topic, I'll provide a more concrete (albeit simple) example. I'll also share some advice from a key contributor to Keycloak.</p>
  
  <p>Let's say we're developing a simple Medium clone that allows users to coedit articles.
  Lance is an already registered and authenticated user that wants to start writing an article on bicycles, so he navigates to an "editing screen" in our SPA.
  Lance then gives it a title, write a few words and hits a "Create" button that sends a POST request to a resource server (already protected by Keycloak). The resource server (service) will then:
  1. Persist the article to a database;
  2. Create a resource via Keycloak's Protection API with its owner attribute set to Lances's user ID and an empty "editors" attribute.</p>
  
  <p>Later on Lance decides that it would be good to have his friend Chris' opinion as well and therefore adds him to the list of editors.
  This could be done via Keycloak's Protection API, too.</p>
  
  <p>This set-up would then allow us to set a JavaScript-Based policy to protect further edits.</p>