-
Bug
-
Resolution: Done
-
Undefined
-
None
-
False
-
-
False
-
-
Before reporting an issue
[X] I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.
Area
admin/fine-grained-permissions
Describe the bug
It's currently not possible to delegate the creation of client roles for single clients to a user.
To create clients roles, the realm-wide "realm-management:manage-clients" role is required.
This issue was created as requested in https://github.com/keycloak/keycloak/issues/28633 to handle the creation of roles
Version
25.0.2
Regression
[X] The issue is a regression
Expected behavior
A client permission is available to allow a user to create roles for a single client via fine grained permissions.
Users with said permission are able to create and manage roles for that client
Actual behavior
None of the client permissions allow creating client roles.
Creating client roles is only possible with realm-management:manage-clients, allowing much more than just administrating a single client.
How to Reproduce?
Similar as described in https://github.com/keycloak/keycloak/issues/28633,
Assigning a user a policy containing the manage permission.
Trying to create a client role results in the error "Forbidden, permission needed: manage-clients"
Anything else?
No response
- links to