TBD IAM <-> Workspace integration allow a user to select other platform users or groups to access shared data

[achtsnits]

at the moment data sharing works via obfuscated links, i.e. anyone with the link hash can access

Salvatore raised the requirement to explicitly select users/groups during data sharing process

questions (partially discussed in meeting 21.11.2024) in this regard

• should a user of the WorkspaceUI be allowed to see all users and groups (=projects) of the platform so he can pick or may that cause concerns like GDPR,... (technically possible and already verified to retrieve all users and groups of Keycloak from WorkspaceUI)
• who is responsible to enforce authorization, done in WorkspaceUI->StorageLayer or should there be a IAM BB sitting in front of the Link (Ingress!)

[w-scho]

Some thoughts regarding enforcement for shared links:
I assume that the list of users who shall be able to access each link differs between links and is typically not known to the IAM. So it cannot protect them systematically without additional information from the Workspace BB.
A simple way to provide this information could be to create an individual link for each user and include the user name or (better) UUID in the path. This would allow the IAM to protect the links in a systematic way using a very simple policy, but somewhat limits the versatility of the shared links. At least on the group level, however, the approach would also work, so that a single link could be shared among a defined group of users.
If more flexibility is required, the Workspace BB needs to provide the relevant information in another way, e.g. by offering access to the list of valid links and the associated users through an API. This way, OPAL could retrieve and replicate this list into OPA, or OPA itself could retrieve single associations on demand. However, this approach would add noticeable complexity and may therefore be less attractive than enforcing authorization within the Workspace BB itself.

[achtsnits]

I like your idea to include the user-guid or group-guid encoded in the link, thanks for this input!