Hi all,
KEYCLOAK-1735 describes that users with the 'manage-users' can role can
self-assign 'manage-realm', and gain substantial extra privileges.
This behaviour came as a substantial surprise to me when I discovered it,
and I suspect there are users out there who have vulnerabilities due to
this unexpected behaviour.
KEYCLOAK-1735 is currently marked as an enhancement, and while I can see
that it might be substantial work to change this behaviour, I think it
should be a priority to make the behaviour clear to users - probably
through documentation, and possibly through renaming the role so that its
expansive powers are clear.
Is this a possibility? What's the best way to get this to happen?
Thanks,
David