Yes, but it would be correct to also write the same Id in AccessToken's User claims so that the Id attribute of casdoorsdk.User structure for in/out operations is the same, isn't it? To resolve this inconsistency, it is better to separate the two structures: one for writing to JWT Claims (with an Id assigned by casdoor), and the other for user modify operations, which will not have the Id field since it is immutable.
And in each organization, is there an opportunity to assign a separate role from the list that is shared between all organizations in the tree?
Well, I’ll try 😅 I need to differentiate access to tenants between users. Each user can belong to multiple tenants in different roles (in one tenant, the user is an administrator, in another, just an editor). My hypothesis on how to do this: a “tenant” is a group in Casdoor, and in the user's profile, the groups field lists all the “tenants” user has access to, and the roles field lists their roles in these groups in the format "admin_of_groupXXX", "editor_of_groupYYY". Access control is managed through the built-in Casbin. This approach has a drawback - we don't have shared admin/editor roles, and new roles are created for each group, which can be cumbersome. Do you have any ideas on how to simplify this?
