Uploaded image for project: 'Red Hat build of Keycloak'
  1. Red Hat build of Keycloak
  2. RHBK-2347

Creating client roles with fine grained permissions is not possible [GHI#31537]

XMLWordPrintable

    • False
    • Hide

      None

      Show
      None
    • False

      Before reporting an issue

      [X] I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

      Area

      admin/fine-grained-permissions

      Describe the bug

      It's currently not possible to delegate the creation of client roles for single clients to a user.
      To create clients roles, the realm-wide "realm-management:manage-clients" role is required.
      This issue was created as requested in https://github.com/keycloak/keycloak/issues/28633 to handle the creation of roles

      Version

      25.0.2

      Regression

      [X] The issue is a regression

      Expected behavior

      A client permission is available to allow a user to create roles for a single client via fine grained permissions.
      Users with said permission are able to create and manage roles for that client

      Actual behavior

      None of the client permissions allow creating client roles.
      Creating client roles is only possible with realm-management:manage-clients, allowing much more than just administrating a single client.

      How to Reproduce?

      Similar as described in https://github.com/keycloak/keycloak/issues/28633,
      Assigning a user a policy containing the manage permission.
      Trying to create a client role results in the error "Forbidden, permission needed: manage-clients"

      Anything else?

      No response

              Unassigned Unassigned
              pvlha Pavel Vlha
              Keycloak UI
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: