Repository navigation
Replies: 3 comments
|
We've noticed that the bug is still present in version 26.7.4. |
|
In latest builds, #50830 is fixed. Targeted for 27.0.0 which I understand from its milestone is due to be released end of March 2027. I wouldn't mind if it got moved to an earlier release :-) Pretty sure it's only a cosmetic/UI problem and that setting up things via Admin REST API will work. |
|
Ok. That's really unfortunate. The API is POST /admin/realms/{realm}/clients/{client-uuid}/authz/resource-server/permission {
"name": "org-permission-admin",
"type": "scope",
"logic": "POSITIVE",
"resourceType": "Organizations"
}Im missing the constraint on the specific organization. |
Uh oh!
There was an error while loading. Please reload this page.
Hi all,
With Keycloak 26.7.0, the release notes introduce "Fine-grained delegation for organization administration", which sounds exactly like what I need: instead of handing out
manage-realm, I want to delegate management of a specific organization to an admin, using the newORGANIZATIONSresource type in Fine-Grained Admin Permissions (FGAP).What I'm trying to do:
Create a permission that scopes an admin's access to one organization only (e.g.
org1), similar to how this already works for groups (where you can pick "Specific groups" and then select the group from a list).The problem:
When I go to
Realm → Organizations → Permissions → Create Permissionand select "Specific Organizations," there is no picker shown to actually choose which organization(s) the permission should apply to. The dropdown/selector that exists for groups is simply missing for organizations.I found what looks like exactly this bug already reported: #50830 – "Cant select specific organizations in FGAP permission". It's filed against 26.7.0, area
admin/ui, still instatus/triageas of now.My questions to the community:
manage-organizations/view-organizations/query-organizationsrealm role path a viable interim workaround for anyone who doesn't need per-organization granularity, until the UI bug is fixed?Any pointers, workarounds, or confirmation that this is indeed just a UI regression (and not a deeper API gap) would be much appreciated.
Thanks,
Mark
All reactions