<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi,<br>
<br>
we just found one admin use case which is not covered by existing
Keycloak and its Admin GUI.<br>
<br>
When you create new Client later and define some default role/s for
it, then there is not any way how to assign these roles to existing
users.<br>
Problem is that default roles are assigned to users in DB when they
are created. Then admin GUI allows to assign roles for one user
only, not too useful when you have hundreds or thousands of users
;-) <br>
Only workaround for now is to write script which uses REST API to
assign new default roles to all existing users. <br>
<br>
I see these possible solutions:<br>
<ul>
<li>do not assign default roles in DB when user is created, but
assign them dynamically when user roles are asked - possible
cons of this solution is that it does not allow to remove
default role from concrete/selected users</li>
<li>keep default roles assignment into DB on user create, but
automatically assign new default role to all existing users once
it is defined for client<br>
</li>
<li>keep default roles assignment into DB on user create, but add
some manual bulk role assignment action into Admin GUI, which
allows admin to assign role to existing users.<br>
</li>
</ul>
WDYT, which solution should be better?<br>
<br>
Cheers<br>
<br>
Vlastimil<br>
<br>
<pre class="moz-signature" cols="72">--
Vlastimil Elias
Principal Software Engineer
jboss.org Development Team</pre>
</body>
</html>