Keycloak Permissions

When using Keycloak, it is sometimes necessary to set permissions in Keycloak for users in BPC.

Only the permissions for role-based authorization (RBA) are listed here. It is also possible to implement this using permissions.

Only one of the listed roles must be assigned at a time. In exceptional cases where multiple roles are required, they are grouped in parentheses.

As an alternative to the roles mentioned, you can always assign the roles admin or realm-admin. However, these are very powerful and should only be assigned with caution.

General BPC Functions

Function Roles Description

Function	Roles	Description
Saving the user’s language in the Keycloak profile	`manage-account`	Required to store the language selected by the user in BPC as the language in the user’s Keycloak profile. This role is often already assigned to every user via `default-roles` when realms are created. If this is enabled in Keycloak `Localization`, all Keycloak screens, such as the login page, will be translated accordingly.
List organizations	`manage-users`, `view-users`, `query-groups`	Retrieves the list of available organizations. This is used to provide a selection in the interface when assigning users to organizations. If the user lacks the necessary permission, they must enter the organizations themselves.
List roles	`manage-realm`, `view-realm`, `query-users`, `query-groups`, `query-realms`, `manage-clients`, `view-clients`	Retrieves the list of available roles. This is used to provide a selection in the user interface when assigning roles. If the user lacks the necessary permission, they must enter the roles manually. Note: Depending on whether the roles are Realm or Client roles, multiple roles may be required. Only the client roles of the Keycloak client used in the BPC are listed.
List permissions	-	Not supported.

Saving the user’s language in the Keycloak profile

manage-account

Required to store the language selected by the user in BPC as the language in the user’s Keycloak profile. This role is often already assigned to every user via default-roles when realms are created. If this is enabled in Keycloak Localization, all Keycloak screens, such as the login page, will be translated accordingly.

List organizations

manage-users, view-users, query-groups

Retrieves the list of available organizations. This is used to provide a selection in the interface when assigning users to organizations. If the user lacks the necessary permission, they must enter the organizations themselves.

List roles

manage-realm, view-realm, query-users, query-groups, query-realms, manage-clients, view-clients

Retrieves the list of available roles. This is used to provide a selection in the user interface when assigning roles. If the user lacks the necessary permission, they must enter the roles manually. Note: Depending on whether the roles are Realm or Client roles, multiple roles may be required. Only the client roles of the Keycloak client used in the BPC are listed.

List permissions

Not supported.

Integrated User Management

The following table summarizes the required roles.

Access Type Roles

Access Type	Roles
Read-only access	`query-users` AND `view-users` AND `view-clients` AND `view-realm`
Administrative management (create/delete users, set permissions)	`manage-users` AND `manage-clients` AND `manage-realm`

Read-only access

query-users AND view-users AND view-clients AND view-realm

Administrative management
(create/delete users, set permissions)

manage-users AND manage-clients AND manage-realm

The following Keycloak permissions are required for the individual functions of integrated identity management.

Function Roles

Function	Roles
User Management
List users	`manage-users`, (`query-users` AND `view-users`)
View user permissions	(`manage-users` AND `view-clients`), (`query-users` AND `view-users` AND `view-clients`)
Add user	`manage-users`
Edit and delete user	`manage-users`
Assign and remove user organizations	`manage-users`
Assign and remove user roles	(`manage-users` AND `manage-clients` AND `manage-realm`)
Set password	`manage-users`
Impersonate a user	(`manage-users` AND `impersonation`)
Organization management
List organizations of the identity provider	`view-users`, `manage-users`
Create organizations	`manage-users`
Delete organizations	`manage-users`
View role assignments	`view-users`, `manage-users`
Extend or remove role assignments	(`manage-users` AND `view-realm` AND `view-client`)
View users in the organization	`view-users`, `manage-users`
Add or remove users to/from the organization	`manage-users`
Role management
List roles of the identity provider	(`view-clients` AND `view-realm`)
Create or delete roles	For realm roles: `manage-realm` For client roles: `manage-clients`
View role assignments	(`view-clients` AND `view-realm`)
Extend or remove role assignments	The base role and the assigned role are client and realm roles: (`manage-client` AND `manage-realm`) Both roles are realm roles: `manage-realm` Both roles are client roles: `manage-client`
Show users who have the role	(`view-clients` AND `view-realm` AND `view-realm`)
Assign or remove a role from a user	(`manage-users` AND `manage-client` AND `manage-realm`)

User Management

List users

manage-users, (query-users AND view-users)

View user permissions

(manage-users AND view-clients), (query-users AND view-users AND view-clients)

Add user

manage-users

Edit and delete user

manage-users

Assign and remove user organizations

manage-users

Assign and remove user roles

(manage-users AND manage-clients AND manage-realm)

Set password

manage-users

Impersonate a user

(manage-users AND impersonation)

Organization management

List organizations of the identity provider

view-users, manage-users

Create organizations

manage-users

Delete organizations

manage-users

View role assignments

view-users, manage-users

Extend or remove role assignments

(manage-users AND view-realm AND view-client)

View users in the organization

view-users, manage-users

Add or remove users to/from the organization

manage-users

Role management

List roles of the identity provider

(view-clients AND view-realm)

Create or delete roles

For realm roles: manage-realm

For client roles: manage-clients

View role assignments

(view-clients AND view-realm)

Extend or remove role assignments

The base role and the assigned role are client and realm roles: (manage-client AND manage-realm)

Both roles are realm roles: manage-realm

Both roles are client roles: manage-client

Show users who have the role

(view-clients AND view-realm AND view-realm)

Assign or remove a role from a user

(manage-users AND manage-client AND manage-realm)

In the Keycloak backend connection settings, you can use the identityProvider_keycloak_addRolesToRealm Parameter to configure whether a new role is created as a realm role, client realm role, or client role. Depending on whether the role already exists and whether it is created as a realm role or a client role, different Keycloak roles mentioned above are required. Only client roles from the Keycloak client used in BPC can be assigned.

Keywords: