On 11/5/2015 1:58 PM, Stian Thorgersen wrote:
Sounds complex and confusing to me. Also how do you specify how's
allowed to manage the role granting permissions?
My proposal is *simpler* and very explicit. All this is is assigning admin permissions to a role.
There would be a realm-wide role for admins that are allowed to set up role granting permissions. Just like we have for view-user, etc. So, the master admin sets up the role granting permissions, then assigns role granting roles to each subset of "junior" admins.
A simpler approach would be to simply require an admin to have a role to
be able to grant it to another user. When an admin creates a role they
would be given that role as well. You an also composite roles to then
achieve the same as you're mentioning above.
I started with that approach, but I thought it was too implicit and confusing. There will be cases where a user has admin permissions for a client, but you don't want to allow them to grant this permission to others. Its like contributors at git hub. Contributors can merge PRs, but they can't grant others contributor access.
On 5 November 2015 at 18:31, Bill Burke <bburke@redhat.com<mailto:bburke@redhat.com>> wrote:
One of things that we need to be able to do if we have the idea of a
"Group Admin" is to control specifically which role mappings an admin is
allowed to grant. One of the places this comes up currently is that if
an admin has the "manage-users" role, they can pretty much add any
permission they want to themselves and get access to the whole realm.
IMO, this is something we need now. It needs to be built into our
admin UI.
So, how could we add the ability to control which roles an admin is
allowed to grant? Under the "Roles" menu option there would be a "Grant
Permissions" tab. Here, the admin can select a role and specify a list
of roles that can be granted if a user has that role.
Here's an example:
Let's say there are 2 sales applications "reporting" and "analytics".
Each of the apps has defined an "admin" and "user" role. We want to have
a developer manage user access to these systems.
1. Define "Sales Access Control Manager" role.
2. Go into "Roles" menu
3. Go to the "Role Granting Permissions" tab.
4. Select the "Sales Access Control Manager" role
5. Select and add the "reporting.user", "reporting.admin",
"analytics.user", and "analytics.admin" roles to the list of roles a
"Sales Access Control Manager" is allowed to grant.