[keycloak-user] realm-management client role "view-realm" needed to view/edit a user?

[EXTERNAL Weimer Benjamin (TNG, INST-CSS/BSV-OS2)]

Hi all,

we are using fine grain permissions in Keycloak to set the rights to edit certain users and have noticed that the roles "manage-users" and "query-realm" of the "realm-management" client are not sufficient to view and edit single users. The "view-realm" role seems to be needed for that. Can you explain me why this role is needed for this action?

Best regards and thanks in advance
Benjamin Weimer