Hi, Thanks for your reply. Sorry I did not found the fine-grained permissions for groups at the first time. Now I think the problem is related to the fact that there is no specific permission for mapping role to a group, as you mentioned. I tried to setup a proper configuration for the described scenario again and run into the following two problems: - Group search by name returns 403 Forbidden, if the user has not the role "view-groups" but the "view" scope permission of a group, which will match the search query. - Mapping a role to a group fails if the user has: - “view” and "manage" permissions of the group and - "map-role" permission of the role Any further hints how to solve these problems? Mit freundlichen Grüßen / Best regards Christoph Leistert (INST/ECS2) Bosch Software Innovations GmbH | Ziegelei 7 | 88090 Immenstaad | GERMANY | www.bosch-si.com<http://www.bosch-si.com> Sitz: Berlin, Registergericht: Amtsgericht Charlottenburg; HRB 148411 B Aufsichtsratsvorsitzender: Dr.-Ing. Thorsten Lücke; Geschäftsführung: Dr. Stefan Ferber, Michael Hahn Von: Pedro Igor Silva <psilva(a)redhat.com&gt; Gesendet: Freitag, 22. Juni 2018 20:05 An: Leistert Christoph (INST/ECS2) <Christoph.Leistert(a)bosch-si.com&gt; Cc: keycloak-user(a)lists.jboss.org Betreff: Re: [keycloak-user] Fine-grained permissions to map a client role to a group Hi, We do support fine-grained permissions for Groups. But I think your problem is related to the fact that there is no specific permission for mapping role to a group. Is that correct? Regarding the "manage-users" role, this is the role that grants access to groups. As well "view-users". Regards. Pedro Igor On Thu, Jun 14, 2018 at 7:41 AM, Leistert Christoph (INST/ECS2) <Christoph.Leistert@bosch-si.com<mailto:Christoph.Leistert@bosch-si.com>> wrote: Hello, We use Keycloak 3.4.3 and we trying to find out a way to let users create clients with a client role and map this client role to a group they are already a member of. For the client creation and client role creation we assigned the realm role "manage-clients" to the users and this is okay for our setup. Additionally the users are assigned to the "query-groups" realm role, so that they could see the groups. We struggle a bit with the right role/permissions setup to map the client role to a group. First, we tried to use realm roles only. However, for mapping a role to a group the "manage-users" role is needed, which allows the user also to e.g. see all users. This should not be possible for these users. Now we try to use fine-grained permissions to realize our scenario. But for the group entity there are no fine-grained permissions and the "map-role" permission of the "Users" resource does not allow to map a role to a group (403 Forbidden). Is there any other way than using the "manage-users" realm role to map a client role to a group? Is it planned to add fine-grained permissions for a "Groups" resource? Mit freundlichen Grüßen / Best regards Christoph Leistert (INST/ECS2) Bosch Software Innovations GmbH | Ziegelei 7 | 88090 Immenstaad | GERMANY | www.bosch-si.com<http://www.bosch-si.com><http://www.bosch-si.co... Sitz: Berlin, Registergericht: Amtsgericht Charlottenburg; HRB 148411 B Aufsichtsratsvorsitzender: Dr.-Ing. Thorsten Lücke; Geschäftsführung: Dr. Stefan Ferber, Michael Hahn _______________________________________________ keycloak-user mailing list keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org> https://lists.jboss.org/mailman/listinfo/keycloak-user