Repository navigation
Delegating Rights: Allow Project Managers to Add Users Only in Their Own Project Subgroups #43079
Unanswered
Laboralphy
asked this question in
Q&A
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Hello everyone,
We are using Keycloak (version 26) to manage identities and access within our organization. Here’s our current structure:
We create "project" groups (e.g., Project_A, Project_B).
Each "project" group contains "application" subgroups (e.g., Project_A/App_1, Project_A/App_2).
Each "application" subgroup further contains subgroups representing permissions (e.g., Project_A/App_1/Read, Project_A/App_1/Write).
Our Requirement:
We want a project manager (a user assigned to a specific "project" group) to be able to add other users only within the subgroups of their own "project" groups, not in other projects. This is a scoped delegation of rights.
Issue:
We are struggling to configure Keycloak to restrict this ability to only the subgroups of the project(s) the manager is responsible for. Currently, either the manager has no permission to add users at all, or they can add users across all subgroups, regardless of the project.
Questions:
Is there a native Keycloak feature (roles, permissions, access policies, etc.) to implement this fine-grained delegation?
If not, what would be the best approach to achieve this (scripts, extensions, advanced configuration)?
Have you implemented a similar mechanism before? If so, could you share your solution or insights?
At best, we have managed to grant the first project manager the necessary rights, but we cannot replicate this for subsequent managers without also giving them access to subgroups outside their own projects.
Technical Context:
Keycloak 26.3
Hierarchical group structure
Strict per-project restriction required
Thank you in advance for your feedback and suggestions!
All reactions