Hello,
yes - the handling is done by Keycloak itself; Last time we looked at user management, we had the following in terms of roles:
Not sure the names of these roles are great.... let's see
Basically I think the role definition in the gist still addresses most of what we want to archive:
* super-user: in charge of managing the UPS realm (including users); can see _ALL_ push applications (that's the admin in Sebi's gist)
* PushAdmin: Someone that can manage applications and variants, but is not able to add new users; he also sees only his applications/variants etc (that's the developer in sebis gist)
The gist also contains a 'Viewer' role - At this point I am not sure we do really need this. My impression is that if we have PushAdmins for our 1.0.0 community release that will be enough.
-Matthias