<div dir="ltr">I don't agree that it's simpler, but I agree with your other points. I'm not to worried about the simplicity as I assume this won't be used by most people, only those that need to limit what roles specific admins can grant.<div><br></div><div>So we need a role to allow granting all roles and a role to manage role granting permissions?</div><div><br></div><div>This further speaks to us introducing role namespaces as then users can define the role granting permissions roles (hm.. simpler did you say?) in a separate namespace.</div><div><br></div><div>BTW in the future with the authz services hopefully users can define their own policies for securing the admin endpoints. We'd ship with some default policies and permissions, then users can change that however they want. The admin endpoints would just be secured by the authz services, rather than our bespoke code we use ATM.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On 5 November 2015 at 21:58, Bill Burke <span dir="ltr"><<a href="mailto:bburke@redhat.com" target="_blank">bburke@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class=""><br>
<br>
On 11/5/2015 1:58 PM, Stian Thorgersen wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Sounds complex and confusing to me. Also how do you specify how's<br>
allowed to manage the role granting permissions?<br>
<br>
</blockquote>
<br></span>
My proposal is *simpler* and very explicit. All this is is assigning admin permissions to a role.<br>
<br>
<br>
<br>
There would be a realm-wide role for admins that are allowed to set up role granting permissions. Just like we have for view-user, etc. So, the master admin sets up the role granting permissions, then assigns role granting roles to each subset of "junior" admins.<span class=""><br>
<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
A simpler approach would be to simply require an admin to have a role to<br>
be able to grant it to another user. When an admin creates a role they<br>
would be given that role as well. You an also composite roles to then<br>
achieve the same as you're mentioning above.<br>
<br>
</blockquote>
<br></span>
I started with that approach, but I thought it was too implicit and confusing. There will be cases where a user has admin permissions for a client, but you don't want to allow them to grant this permission to others. Its like contributors at git hub. Contributors can merge PRs, but they can't grant others contributor access.<br>
<br>
<br>
<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">
On 5 November 2015 at 18:31, Bill Burke <<a href="mailto:bburke@redhat.com" target="_blank">bburke@redhat.com</a><br></span><div><div class="h5">
<mailto:<a href="mailto:bburke@redhat.com" target="_blank">bburke@redhat.com</a>>> wrote:<br>
<br>
One of things that we need to be able to do if we have the idea of a<br>
"Group Admin" is to control specifically which role mappings an admin is<br>
allowed to grant. One of the places this comes up currently is that if<br>
an admin has the "manage-users" role, they can pretty much add any<br>
permission they want to themselves and get access to the whole realm.<br>
<br>
IMO, this is something we need now. It needs to be built into our<br>
admin UI.<br>
<br>
So, how could we add the ability to control which roles an admin is<br>
allowed to grant? Under the "Roles" menu option there would be a "Grant<br>
Permissions" tab. Here, the admin can select a role and specify a list<br>
of roles that can be granted if a user has that role.<br>
<br>
Here's an example:<br>
<br>
Let's say there are 2 sales applications "reporting" and "analytics".<br>
Each of the apps has defined an "admin" and "user" role. We want to have<br>
a developer manage user access to these systems.<br>
<br>
1. Define "Sales Access Control Manager" role.<br>
2. Go into "Roles" menu<br>
3. Go to the "Role Granting Permissions" tab.<br>
4. Select the "Sales Access Control Manager" role<br>
5. Select and add the "reporting.user", "reporting.admin",<br>
"analytics.user", and "analytics.admin" roles to the list of roles a<br>
"Sales Access Control Manager" is allowed to grant.<br>
<br>
</div></div></blockquote><div class="HOEnZb"><div class="h5">
<br>
<br>
-- <br>
Bill Burke<br>
JBoss, a division of Red Hat<br>
<a href="http://bill.burkecentral.com" rel="noreferrer" target="_blank">http://bill.burkecentral.com</a><br>
</div></div></blockquote></div><br></div>