Repository navigation
manage-users realm management role is a way too broad! #14454
Unanswered
mindarchitect
asked this question in
Q&A
Replies: 1 comment 1 reply
|
I also want to have a specific role for creation of user. In current moment for creation of user I need to provide manage-users role. This role is very broad |
1 reply
|
I think it is duplicate discussion. There is a similiar discussion |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Description
Hi
Keycloak 19.0.1
Maybe I am missing something but can not find a way to restrict newly created client role to user creation only. Seems like manage-user do the job but from security perspective it is way too broad.
How can i reduce role scope only to standard CRUD actions for service account roles?
I use only Keycloak REST API + Spring Boot Adapter for authorization.
P.S.
Keycloak has very poor practical examples docs. It is really hard to understand those concepts without meaningful app examples..
I do not understand why this decision was made to combine all possible user management actions into 1 role only. What if I do not need to read users, delete them etc? Why it was done in such a "all or nothing" way???
Why not introduce standard CRUD roles instead?
Regards,
Andrey
Discussion
No response
Motivation
No response
Details
No response
All reactions