Re: [keycloak-dev] Restrict admins to only allow granting roles they are privileged to

+1 for the simple fix, however I agree that more flexibility might be needed. We may need some more fine grained authorization. For example user is authorized to manage application "app1" but not application "app2" (currently user with "manage-applications" role can manage any application). Similarly I may want some user to grant/revoke other users all application roles of particular application etc. I wonder if we should add the concept of "permission" ? Basically permission would consist of action and target object (could support wildcards). Permissions are given to roles. For example current role "manage-applications" will have permissions like this: - create-applications - update-applications: * - remove-application: * So member of this role can CRUD any application. Now when users from role "myapp1/foo-role" should be able to grant/revoke this role to other users, the permission given to the foo-role will be: - grant-role: "myapp1", "foo-role" When users from role "myapp1/bar-role" should be able to grant/revoke all roles from application "myapp1" to other users, the permission will be: - grant-role: "myapp1", "*" The tricky part is to have the permission model flexible enough, but not be too complex at the same time;-) Maybe it should be driven mainly by real use-cases from community? Marek On 25.3.2015 06:49, Stian Thorgersen wrote: