JBoss.orgCommunity Documentation

Chapter 7. Per Realm Admin Access Control

7.1. Realm Roles

Administering your realm through the master realm as discussed in Chapter 6, Master Admin Access Control may not always be ideal or feasible. For example, maybe you have more than one admin application that manages various admin aspects of your organization and you want to unify all these different "admin consoles" under one realm so you can do SSO between them. Keycloak allows you to grant realm admin privileges to users within that realm. These realm admins can participate in SSO for that realm and visit a keycloak admin console instance that is dedicated solely for that realm by going to the url: /{keycloak-root}/admin/{realm}/console

Each realm has a built-in application called realm-management. This application defines roles that define permissions that can be granted to manage the realm.

  • realm-admin - This is a composite role that grants all admin privileges for managing security for that realm.

These are more fine-grain roles you can assign to the user.

  • view-realm - View the realm configuration
  • view-users - View users (including details for specific user) in the realm
  • view-applications - View applications in the realm
  • view-clients - View clients in the realm
  • view-events - View events in the realm
  • manage-realm - Modify the realm configuration (and delete the realm)
  • manage-users - Create, modify and delete users in the realm
  • manage-applications - Create, modify and delete applications in the realm
  • manage-clients - Create, modify and delete clients in the realm
  • manage-events - Enable/disable events, clear logged events and manage event listeners

Manage roles includes permissions to view (for example a user with manage-realm role can also view the realm configuration).

To add these roles to a user select the realm you want. Then click on Users. Find the user you want to grant permissions to, open the user and click on Role Mappings. Under Application Roles select realm-management, then assign any of the above roles to the user by selecting it and clicking on the right-arrow.