Keycloak Permissions

When using Keycloak, it is sometimes necessary to set permissions in Keycloak for users in BPC.

Only the permissions for role-based authorization (RBA) are specified here. It is also possible to implement this using permissions.

Only one of the listed roles must be assigned at a time. In exceptional cases where multiple roles are required, they are grouped in parentheses.

As an alternative to the roles mentioned, you can always assign the roles admin or realm-admin. However, these are very powerful and should only be assigned with care.

General BPC Functions

Function Roles Description

Function	Roles	Description
Saving the user’s language in the Keycloak profile	`manage-account`	Required to store the language selected by the user in BPC as the language in the user’s Keycloak profile. This role is often already assigned to every user via `default-roles` when realms are created. If this is enabled in Keycloak `Localization`, all Keycloak screens, such as the login page, will be translated accordingly.
List organizations	`manage-users`, `view-users`, `query-groups`	Retrieves the list of available organizations. This is used to provide a selection in the interface when assigning organizations. If the user lacks the necessary permission, they must enter the organizations themselves.
List roles	`manage-realm`, `view-realm`, `query-clients`, `query-users`, `query-groups`, `query-realms`, `manage-clients`, `view-clients`	Retrieves the list of available roles. This is used to provide a selection in the interface when assigning roles. If the permission is missing, the user must enter the roles manually. Note: Depending on whether these are realm or client roles, multiple roles may be required.
List permissions	-	Not supported.

Saving the user’s language in the Keycloak profile

manage-account

Required to store the language selected by the user in BPC as the language in the user’s Keycloak profile. This role is often already assigned to every user via default-roles when realms are created. If this is enabled in Keycloak Localization, all Keycloak screens, such as the login page, will be translated accordingly.

List organizations

manage-users, view-users, query-groups

Retrieves the list of available organizations. This is used to provide a selection in the interface when assigning organizations. If the user lacks the necessary permission, they must enter the organizations themselves.

List roles

manage-realm, view-realm, query-clients, query-users, query-groups, query-realms, manage-clients, view-clients

Retrieves the list of available roles. This is used to provide a selection in the interface when assigning roles. If the permission is missing, the user must enter the roles manually. Note: Depending on whether these are realm or client roles, multiple roles may be required.

List permissions

Not supported.

Integrated User Management

The following Keycloak permissions are required for the individual functions of the integrated user management.

Function Roles

Function	Roles
List users	`manage-users`, `query-users`
Display user permissions	`manage-users`, (`query-users` AND `view-users`)
Add user	`manage-users`
Edit user	`manage-users`
Set password	`manage-users`
Impersonate user	(`manage-users` AND `impersonation`)

List users

manage-users, query-users

Display user permissions

manage-users, (query-users AND view-users)

manage-users

manage-users

manage-users

(manage-users AND impersonation)

Editing user permissions is currently not supported.

Keywords: