Repository navigation
Replies: 3 comments 7 replies
|
I created a bug for the Still it would be nice if this inheritance would somehow apply for all group related permissions :) |
|
I think this would become extremely complicated if we allowed inheritance. Also, current users may be relying on the current behavior. So inheritance would have to be optional. |
|
We are running into a similar problem now. The issue is we would like to allow a non-admin client to "own" a group and be able to freely create and manage subgroups under it. With the current model, fine-grained permissions can be configured to allow this client to create subgroups, but since the child is created without fine-grained permissions enabled, and the client in question does not have realm-level privileges to configure fine-grained permissions globally, the newly created subgroup is effectively "lost" for that client -- they can see it as a subgroup when querying the parent, but they cannot query the subgroup, configure permissions on it, add/remove members, etc. I understand that allowing inheritance would create additional complexity, but what about automatically cloning the parent's fine-grained permissions when creating subgroups? Wouldn't that be a sensible default? This would allow a client with permissions on |
|
@thw0rted imo this would be a possibility, but would create a lot of (maybe unnecessary) copies of the fine-grained permission settings. Also syncing changes on the parent would then again be complicated... and you would need a toggle during the creation of the subgroup whether you wanna create those settings or not. Coming back to my intial idea and the feedback from @ssilvert it could be implemented like this:
But as there is a discussion pending for Advanced Groups I am not sure if this topic is still that relevant... |
|
Yes! This solution - an optional inheritance of the parents' permissions - would be great! We are dealing with a possibility to let some users administer a group, create subgroups and populate them, but the problem is that, everytime they create a child group, an admin needs to copy permissions there. |
|
Seconding. Optional inheritance of the parents' permissions would indeed be great. |
|
Optional inheritance would be absolutely essential for me as well. |
|
I am evaluating the fine-grain-admin-authz feature. My Keycloak version is 26.1.4. Note: I have also mentioned the same comment here |
Uh oh!
There was an error while loading. Please reload this page.
Hi everyone,
I am currently trying out some things with the fine grained authorization for groups and found out that it seems it is currently not possible to inherit permissions to child groups. Example:
query-groupsparentparentwith the name childparentviewpermission of theparentgroupYou will then be able to view the parent group but will receive a 403 error when trying to access the child group. Same thing applies for the other permissions (e.g. view-members -> with the
query-usersrole added to the user I will only see users of the parent role, but not of the child role in the users overview). Only workaround would be to explicitly add permissions to every group.In my opinion group permissions should be extended to the children.
You are also able to see all groups in the overview, not only the once you have the view permission for (maybe a filter should be added here?)
All reactions