Re: [keycloak-dev] Hide internal clients and roles
----- Original Message -----
From: "Bill Burke" <bburke(a)redhat.com>
To: keycloak-dev(a)lists.jboss.org
Sent: Wednesday, 10 June, 2015 4:08:16 PM
Subject: Re: [keycloak-dev] Hide internal clients and roles
I think security-admin-console and realm-management should be merged in
non-Master realms. In master realm, rename everything to
<realm>-security-admin-console. Finally, an internal role or client
would not be able to be deleted.
I don't think you should hide any roles ever. I don't see why you would
want to. I do think you should make internal clients and roles unremovable.
Hiding the internal realm roles would enable a "blank slate" page on the realm
roles list. Alternatively, and I actually think this is a better idea, is to make the
admin and create-realm roles roles of the master-security-admin-console realm rather than
realm roles. In that case all we need is "internal" clients and an option to
view/hide them on the clients list.
Which one is it btw "an internal role or client would not be able to be deleted"
or "I do think you should make internal clients and roles unremovable"?
On 6/10/2015 9:46 AM, Marek Posolda wrote:
> I am like 50/50 . I can imagine this has some advantages as people won't
> be easily able to delete system clients/roles and break their keycloak
> server.
>
> On the other hand, when I am admin, I might be confused why some roles
> are not in the roles list, but are in default roles list etc? Also if
> someone really knows what he is doing, this might be unwanted
> restriction - for example people may want to add more composite roles
> into "admin" role or they want to disable account client as Vlasta
> pointed etc.
>
> Marek
>
> On 10.6.2015 09:19, Stian Thorgersen wrote:
>> I propose we add an attribute 'kc_internal' to internal clients
>> (security-admin-console, master-realm, account, broker) and hide these
>> from the clients table.
>>
>> We should also do this to internal roles 'admin' and
'create-realm' so
>> these roles are not displayed in realm roles list. They would only be
>> hidden from this page, but still be visible in user role mapping, scope
>> mappings and default roles.
>> _______________________________________________
>> keycloak-dev mailing list
>> keycloak-dev(a)lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-dev
>
> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-dev
>
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
_______________________________________________
keycloak-dev mailing list
keycloak-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-dev