You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Adding Users to child groups "Error response 403: org.keycloak.services.ForbiddenException"
#20616
We had Keycloak 17 and recently migrated to 20.0.3. We are facing issues with manage-membership.
What is happening is:
We create a parent group abc
We create child group, called abc-admin group
At Role Mapping
Go to realm-management, grant view-realm & view users
Enable Permissions
Create a Policy called abc-admin with type Group
Add abc-admin group to abc-admin policy
Go back to abc-admin group permission and add the policy
Go to Users
Permissions -> Manage-group-memphership
Add abc-admin policy
Now abc-admin members should be able to view all users and add any users to abc-admin group
Go back to the parent group abc to apply the policy so all child groups can be manage by members in abc-admin
Results:
Members in abc-admin can only add/remove users to Parent group abc and abc-admin and child group of abc has the policy but it doesnt work, we see error below 2023-05-27 09:40:21,416 DEBUG [org.keycloak.services.error.KeycloakErrorHandler] (executor-thread-4440) Error response 403: org.keycloak.services.ForbiddenException at org.keycloak.services.resources.admin.permissions.GroupPermissions.requireManageMembership(GroupPermissions.java:374) at org.keycloak.services.resources.admin.UserResource.joinGroup(UserResource.java:946)
I am not sure what was changed, in keycloak 17 it was weird as well some users can manage the child groups and some can't, in version 20 its not OK as well, any advise will be appreciated.
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with he
3389
art emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
We had Keycloak 17 and recently migrated to 20.0.3. We are facing issues with manage-membership.
What is happening is:
abcview-realm&view usersabcto apply the policy so all child groups can be manage by members in abc-adminResults:
2023-05-27 09:40:21,416 DEBUG [org.keycloak.services.error.KeycloakErrorHandler] (executor-thread-4440) Error response 403: org.keycloak.services.ForbiddenException at org.keycloak.services.resources.admin.permissions.GroupPermissions.requireManageMembership(GroupPermissions.java:374) at org.keycloak.services.resources.admin.UserResource.joinGroup(UserResource.java:946)I am not sure what was changed, in keycloak 17 it was weird as well some users can manage the child groups and some can't, in version 20 its not OK as well, any advise will be appreciated.
All reactions