Fine-grained permissions issues: unable to manage specific groups, clients.

Before reporting an issue

• I have searched existing issues
• I have reproduced the issue with the latest nightly release

Area

admin/fine-grained-permissions

Describe the bug

Fine-grained permissions are not working correctly blocking semi-admin access provision to development teams.

Version

22.0.1

Expected behavior

Background:

• We utilize Keycloak to manage permissions across numerous clients within one realm.
• Permissions are not directly mapped to users. We use groups to mediate in roles mapping (users < groups < mapped roles).
• We aim to have a set of "semi-admin" permissions for our Dev & QA teams to allow them to test applications without the need for full KC Admin rights or KC admins assistance.

Required Permissions for "semi-admin":

• Manage specific clients: roles, scopes, sessions, and configurations (incl. Advanced tab).
• Manage specific groups: members, mapped roles.
• User management: impersonation.

Planned Configuration:

We aim to use fine-grained permissions for "semi-admin" rights across all Groups and Clients with Permissions enabled. This strategy helps restrict access, prevents unintended upgrades to full realm-admin, and guards against inadvertent access to sensitive areas which are supposed to be inaccessible for “semi-admins” due to having Permissions disabled. Using direct permissions for each scope and client complicates management. Our envisioned approach is as follows:

• Use a group for “semi-admins”
• Use Policy that allows "semi-admins" users group the necessary permissions:
  • Permissions to manage, view, manage-group-membership of the “User” resource.
  • Permissions to manage, map-roles, map-roles-client-scope of all “Client”-type resources with Permissions enabled.
  • Permissions to manage, manage-members, manage-membership, view, view-members of all “Group”-type resources with Permissions enabled.
• Use Additional roles of realm-managment mapped to “semi-admins” users group:
  • view-users
  • query-users
  • view- realm (because of · Issue https://github.com/keycloak/keycloak/issues/22175 · keycloak/keycloak (github.com))
  • query-clients
  • query-groups

Actual behavior

Issues Faced:

1. The "Role mapping" tab The "Role mapping" tab in a Group is not visible for "semi-admin". This seems to be an issue that has been submitted previously. https://github.com/keycloak/keycloak/issues/20125

2. Can't manage clients "Semi-admins" cannot manage Clients with Permissions turned on. Direct permissions (not for resource type Clients, but direct manage, map-roles, map-roles-client-scope of a specific client) provision is not fully addressing the issue as:

• Advanced tab of the client is still not editable
• Roles creation returns “Forbidden, permission needed: manage-clients” (we can't grant that permission since it would allow management of all realm clients, conflicting with our objectives)
• Roles deletion works fine
• Renaming the 'direct' permission (e.g., from 'manage.permission.client.ID' to a custom 'A-Z') causes it to malfunction, even though the Resources, Authorization scopes, and Policies remain unchanged. It complicates the Permissions management we aim to simplify

3. 'Map-roles-client-scope' doesn’t work as expected

Semi-admins can map roles from client A to client B's Dedicated scope with the following configuration, although it doesn't work with the 'Broad' setup we're targeting:

• Client A: Direct permissions set for 'map-roles' and 'map-roles-client-scope' (Path: Specific client > Permissions).
• Client B: Direct permission set for 'manage' (Path: Specific client > Permissions > manage)."

How to Reproduce?

Execute the following with described configuration as semi-admin:

• Manage specific clients: roles, scopes, sessions, and configurations (incl. Advanced tab).

• Manage specific groups: members, mapped roles.

• User management: impersonation.

• Users group Group_Groups_Manager_Test

  • Roles mapped to the group:
    • view-users
    • query-users
    • view- realm (because of · Issue #22175 · keycloak/keycloak (github.com))
    • query-clients
    • query-groups

• Policy: Group_Groups_Manager_Test_Policy

  • Group: /Group_Groups_Manager_Test
  • Logic: Positive

• realm-management permissions:

  • Users_Manager_Test_Permission_Scope_Based
    • Scope Based
    • Apply to resource type: Off
    • Resource: Users
    • Authorization scopes: manage, view, manage-group-membership
    • Policies: Group_Groups_Manager_Test_Policy
    • Decision strategy: Unanimous
  • Groups_Manager_Test_Permission_Scope_Based
    • Scope Based
    • Apply to resource type: On
    • Resource: Groups
    • Authorization scopes: manage, manage-members, manage-membership, view, view-members
    • Policies: Group_Groups_Manager_Test_Policy
    • Decision strategy: Unanimous
  • Clients_Manager_Test_Permission_Scope_Based
    • Scope Based
    • Apply to resource type: On
    • Resource: Client
    • Authorization scopes: manage, map-roles, map-roles-client-scope
    • Policies: Group_Groups_Manager_Test_Policy
    • Decision strategy: Unanimous

Anything else?

• Server info
  • Version 22.0.1
  • Product: Default