Re: [keycloak-dev] user groups vs. client groups

On 5 November 2015 at 15:01, Bill Burke <bburke(a)redhat.com&gt; wrote: I've never the concept of realm and client roles. It's been difficult to explain and strange to use. I've always just used realm roles. It's a strange and limiting concept. Introducing client groups with further places to define roles just makes matters even worse. Now users have two go 3 different places to define roles: * Realm * Client Groups * Clients What happens if a client group and a client both have the same role by the way? It's a strange limitation. At least personally if I was using Keycloak I would simply use realm roles alone and define my own hierarchy with a delimiter. It's much better to have a single place to define roles, under the roles tab. Then allow users can define the namespaces/hierarchy they want. Role namespaces are easier to deal with and at the same time more flexible. I just don't see any reason why we would have roles specific to a client or client group. This is another reason why we need role namespaces. With a role namespace we can define internal roles that then don't end up conflicting with users own roles. For example as we have a role admin atm users can't define their own admin role and will have to name it differently. I think the fact that we have internal abstract clients to be able to create a namespace for internal admin roles speaks for itself. Some will want to have roles associated with a client (email-user), but others have organizational wide roles (manager, sales-guy, etc..). Role namespaces can deal with both, but client roles can't.