title: Keycloak resource protection recommendations
body: <p>I'm writing web services in Spring Boot and I use Keycloak to protect the application. The app will expose API to manage restaurants.</p>
  
  <p>In <strong>Keycloak</strong> I have two roles: <strong>admin</strong> and <strong>manager</strong>.</p>
  
  <p>A user with <strong>admin</strong> role can CRUD restaurants. The same company has multiple restaurants and each restaurant has a manager. <strong>I want users with manager role to be able to edit only their restaurant</strong> (<em>the restaurant they manage</em>).</p>
  
  <p>According to my understanding of Keycloak's documentation I have to use <strong>Resource</strong> with <strong>Permission</strong> but they stated that:</p>
  
  <blockquote>
    <p>[] you can also have a different resource named Alice’s Banking Account, which represents a single resource owned by a single customer, which can have its own set of authorization policies.</p>
  </blockquote>
  
  <p>To do that I have to create a resource like this <code>/api/restaurants/12345</code> but the thing is that I can't hardcode an ID like this.</p>
  
  <p>For now I protected my endpoint like this in spring boot:</p>
  
  <pre class="lang-java prettyprint-override"><code>http
    .authorizeRequests()
    .mvcMatchers(HttpMethod.PUT, "/api/restaurants/*").hasAnyRole("ADMIN", "MANAGER")
    .anyRequest().permitAll();
  </code></pre>
  
  <p>This means that any manager from any restaurant can edit another restaurant. I want to limit that to their restaurant only (<em>the restaurant they manage</em>). <strong>How can I do that in Keycloak</strong> if at all possible?</p>