Hey Pavel, it seems you need role based access control, there is link [1] where Fine grain permissions described, it may help you. [1] V. On 3/5/19 9:47 PM, Pavel Micka wrote:

Hi, I tried that yesterday. The issue with fine grained permissions is that is an alpha feature... and we have not been able to make it fully working with role -> user assignments. I had there policy to allow assignment once the time is > 2020-01-01, but the assignments (role->user) were granted successfuly. On the other hand the same policy worked flawlesly for assigments of roles to composite roles (forbidden). So I suppose that this alpha feature still has some glitches... Also as the fine grained permissions are extension to the standard permissions in Keycloak, so they can be used only to restrict the existing (top level) permissions. But afaik there is no fine grained permission for realm settings (https://www.keycloak.org/docs/latest/server_admin/index.html#full-list-of...), hence you can't grant realm_settings + roles on the top level and use fine grained permission to narrow the permissions to roles only. Best regards, Pavel -----Original Message----- From: Vlasta Ramik <vramik(a)redhat.com&gt; Sent: Wednesday, March 6, 2019 10:00 AM To: Pavel Micka <Pavel.Micka(a)zoomint.com>; keycloak-user(a)lists.jboss.org Subject: Re: [keycloak-user] Remove permission to manage realm (but keep managing roles) ... and there is the link: https://www.keycloak.org/docs/latest/server_admin/index.html#_fine_grain_... On 3/6/19 9:53 AM, Vlasta Ramik wrote: