Fiware IDM-Keyrock：如何使用Keyrock API检查用户是否具有某些许可权（permission_fiware）

Question

I created some permissions(permission_fiware table) in Horizon regarding urls that can or cant be seen.I created permission(name:Upload images, with resource: "/image_upload") and role(role_fiware) admin that has this permission. Now i want to check whether some user that is logged in to my application can view that page on url "/image_upload" that i defined in horizons permission.So my guess is i should first check what roles user has, and after that whether those roles that user is assigned have required permission. So, my question is next: How can i list what permission one specific user has. In Keyrocks API:

http://docs.keyrock.apiary.io/#reference/keystone-extensions/role-user-relationships/list-users-role-assignments

i found how i can list all permissions for a specific role

http://keyrock/OS-ROLES/roles/role_id/permissions

but how can i get information about what roles(role_fiware) are assigned to a user?

Answer 1

As stands in the FIWARE-IDM documentation doing a request against the resource user of your IDM host using the access_token , will return the user information, and within that information you will find the roles that user have assigned:

GET
/user?access_token=XXXXXXXXXXXXXXXXXXXX


Response:

{
  "organizations": [{
    "website": "",
    "city": "",
    "name": "Franchise1",
    "img": "/static/dashboard/img/logos/small/group.png",
    "domain_id": "default",
    "enabled": true,
    "id": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
    "roles": [{
      "name": "Franchise manager",
      "id": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
    }],
    "email": "",
    "description": "Test Organization"
  }],
  "displayName": "user1",
  "roles": [{
    "name": "End user",
    "id": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  }],
  "app_id": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
  "email": "user1@test.com",
  "id": "user1"
}