<div dir="ltr">We're aware that permissions are not fine grained enough at the moment and we are planning on providing something better in the future. It will however be a while until we are able to do so.</div><div class="gmail_extra"><br><div class="gmail_quote">On 22 July 2016 at 16:36, Valerij Timofeev <span dir="ltr"><<a href="mailto:valerij.timofeev@gmail.com" target="_blank">valerij.timofeev@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi,<br><br>after reading the ticket KEYCLOAK-528 I've encountered two other issues in the "security-admin-console" application (tested on RH SSO 7.0.0): <br><br>1) As soon as a realm user gets the 'manage-users' role, he can manage "User federation" settings and even delete it. This can result in unintentional removal of all users linked with the user federation provider and thus affect potentially millions of users.<br><br>2) Users having 'view-users' role can view "User Federation". "Delete" button is visible as well although it does not work finally.<br><br>IMO "User federation" should be covered by the realm management roles instead. <br><br>Additionally the provided roles for the 'realm-management' client are not fine grained enough IMO. One role per REST method would be ideal and, I suppose, simplier to consider in the Keycloak Admin API.<br><br>The "security-admin-console" application without fine grained roles exposes too much risk in real life scenarios and so makes it unusable. One use case in mind: prevent deletion of any kind for Helpdesk employees e.g. managing users. Having dedicated roles for DELETE operation would make such task possible.<br><br>Kind regards<span class="HOEnZb"><font color="#888888"><br>Valerij Timofeev<br><br></font></span></div>
<br>______________________________<wbr>_________________<br>
keycloak-user mailing list<br>
<a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">https://lists.jboss.org/<wbr>mailman/listinfo/keycloak-user</a><br></blockquote></div><br></div>