Admin permission question #42021

mkopeyka · 2025-08-20T22:35:42Z

mkopeyka
Aug 20, 2025

Hello,

I use keycloak v26.3.2.
My realm has role super-admin and group support
I need to configure admin permissions in this way:

members of support group may manage all users except users with role super-admin

My solution:

permission to manage all users
- Enforce access to all users
- Positive group based policy for support group
permission to not manage users with super-admin role
- Enforce access to specific users (list of users with role super-admin)
- Negative group based policy for support group

This solution works until a new user is added to the super-admin role because nobody remember to add new user to permission.

Is it possible to manage access to the users with specific role?