Repository navigation
Allow extending fine-grained admin permissions for groups to their children - #55019
Draft
baptistegh wants to merge 1 commit into
Draft
baptistegh wants to merge 1 commit into
baptistegh wants to merge 1 commit into
Conversation
…ildren Adds an opt-in "Extend to children" option (extendChildren in the REST API) to admin permissions for specific groups. When enabled, the permission also applies to all the subgroups of the selected groups, including subgroups created later, so that the administration of a group hierarchy can be delegated. A subgroup's own permission for a scope takes precedence over inherited ones. For group scopes, the closest ancestor with an extended permission decides. For member scopes, a deny from any extended ancestor wins, consistently with the existing member scope cascading. Inherited permissions are also taken into account when searching groups and users. Closes keycloak#43865 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Baptiste Gouhoury <gouhoury.baptiste@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #43865
Decisions
view-membersand the other member scopes, a deny from any extended parent wins. This matches how member scopes already cascade for users, so group-level checks, user checks and search agree.view-membersis extended (partially addresses Unable to view childgroup users with view-members permission on the parent group #16966).Known limitations
Testing
New
GroupResourceTypeExtendChildrenTest(18 tests) and two Playwright tests for the permission form. All 292 tests inorg.keycloak.tests.admin.authz.fgappass.