You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
One issue suggests the direction here is towards organization-specific RBAC roles. The top level Organizations tracking issue is clear this work is not complete.
I have a goal to provide users access to the admin api to manage users, without being realm admins in a realm with organizations enabled. This currently fails as accessing a user's page generates a GET to realm/organizations which returns a 403 (expected given above).
I'm happy to make an attempt at supporting this but would like to clarify - should RBAC for organizations admin:
follow the pattern given in the admin-ui code (query-groups and manage-users), or
should new realm management roles for organizations be created (ie (manage|view|query)-organizations) and added to the manage-realm composite role?
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
In the
admin-uiJavascript Organizations routes are protected byquery-groupsfor list andmanage-usersfor add and edit.The corresponding API's all require
manage-realm.One issue suggests the direction here is towards organization-specific RBAC roles. The top level Organizations tracking issue is clear this work is not complete.
I have a goal to provide users access to the admin api to manage users, without being realm admins in a realm with organizations enabled. This currently fails as accessing a user's page generates a GET to
realm/organizationswhich returns a 403 (expected given above).I'm happy to make an attempt at supporting this but would like to clarify - should RBAC for organizations admin:
admin-uicode (query-groupsandmanage-users), or(manage|view|query)-organizations) and added to themanage-realmcomposite role?All reactions