Add impersonate-members scope to group resource type #38659
Conversation
|
@sschu Can you please check this one? I think it is aligned with what we discussed ... |
|
@pedroigor I believe we should update this: by saying something like: |
Makes sense, I'll update the docs. |
|
@vramik Added your suggestion to the upgrade guide. |
|
@pedroigor thanks, lgtm. I'd love to have @sschu's review as well. |
|
@pedroigor @vramik I'll have a look. Will probably only finish tomorrow, I hope thats OK. |
| The evaluation takes permissions for specific resources (specific user permissions and specific group permissions) first. | ||
| See <<_resolving-conflicting-permissions, Resolving Conflicting Permissions>> for more information. | ||
| - Similarly, the *manage* operation takes *manage-members* into account when managing group members. | ||
| - Similarly, the *manage* operation takes *manage-members* into account when managing group members. |
There was a problem hiding this comment.
@pedroigor we should probably mention here that this "taking-into-account" applies to impersonation as well, wdyt?
There was a problem hiding this comment.
Added a second commit with some updates to the docs. I can send a separate PR if you prefer, but perhaps we can just agree on it here.
docs/documentation/server_admin/topics/admin-console-permissions/fine-grain-v2.adoc
Show resolved
Hide resolved
e49c2a5 to
5045b62
Compare
|
@pedroigor @vramik I finally tested this branch and the impersonate-part works as expected. However, I found some issues with the view-members and manage-members permissions. I'll send you a reproducer directly via mail. |
Closes keycloak#38566 Signed-off-by: Pedro Igor <[email protected]>
Signed-off-by: Pedro Igor <[email protected]>
e10192c to
c609e34
Compare
Closes #38566