Manage Multitenancy with Users Logging in via Keycloak

Summary Implement multitenancy management for users logging in via Keycloak. Currently, Directus already retrieves the list of Keycloak groups from the JWT token, reads them, and based on the environment variable AUTH_KEYCLOAK_ROLE_MAPPING, it selects the first matching role ID and assigns that role to the user. The system should allow multiple roles to be assigned to a user in this way (e.g., if two groups match two role IDs, both roles should be assigned to the user). Each role must have specific permissions to manage/view various collections and schemas. Basic Example _No response_ Motivation Native multitenancy management in this way would make Directus an excellent candidate for project use cases requiring SSO (and non-SSO) access for multiple users who need cumulative and dynamically assigned permissions. Detailed Design The user should have a list of assignable roles instead of a single role. The permissions derived from this should be additive, not subtractive (if a …