Allow managing realm admin roles if the the realm-admin role is granted #43584
Conversation
50739d8 to
6acae17
Compare
vramik
left a comment
There was a problem hiding this comment.
Hi @pedroigor, thanks for this PR.
I'm looking at the changes, and I'm a bit confused about the new direction regarding admin role mappings.
My understanding from our previous discussion was that we explicitly decided only server admins should be allowed to map admin roles, and we would not extend this privilege to delegated realm admins.
Based on that agreement, I created:
PR 41145 (#41145) to enforce this restriction.
PR 40271 (#40271) to document this behavior in the release notes.
I also closed (as not planned) a couple of other issues based on that decision.
This PR seems to reverse that decision and allow delegated admins to manage these roles. Could you share the reasoning behind this change?
I just want to make sure I'm on the same page and understand the new context, especially since we'll need to update the documentation if we proceed with this new approach. Also do you plan to backport this change? Thanks!
I think we missed the difference between a |
|
Ah, thanks for that clarification, @pedroigor. That distinction between My takeaway from our original discussion was more restrictive than we now want. The current behavior in 26.3/26.4 is that only server admins can map these roles. This PR will change that behavior for 26.5 by "giving back" this permission to the We need to make sure we document this change in the 26.5 release notes, as it's a change from the behavior we documented before. |
services/src/main/java/org/keycloak/services/resources/admin/fgap/AdminPermissions.java
Show resolved
Hide resolved
56c9fa7 to
71c1218
Compare
vramik
left a comment
There was a problem hiding this comment.
Thanks @pedroigor, this is great.
- I've suggested two small doc changes to improve clarity. Let me know what you think.
- It also looks like some tests need updating.
Once the tests are addressed, this should be ready to merge.
docs/documentation/server_admin/topics/admin-console-permissions/fine-grain-v2.adoc
Outdated
Show resolved
Hide resolved
docs/documentation/server_admin/topics/admin-console-permissions/fine-grain-v2.adoc
Outdated
Show resolved
Hide resolved
services/src/main/java/org/keycloak/services/resources/admin/fgap/AdminPermissions.java
Show resolved
Hide resolved
Closes keycloak#43579 Closes keycloak#43578 Signed-off-by: Pedro Igor <[email protected]> Co-authored-by: Vlasta Ramik <[email protected]>
5907312 to
a585225
Compare
Closes #43579
Closes #43578