50877 [DOC][FGAPv2] Clarify that manage and manage-members for users allow creating users#50881
Conversation
…allow creating users Signed-off-by: Sebastian Schuster <sebastian.schuster@bosch.com>
There was a problem hiding this comment.
Pull request overview
Note
Copilot couldn't run its full agentic review because no GitHub Actions runner was available. Make sure your repository has a runner available to run Copilot's review, or add a copilot-setup-steps.yml file specifying one with the runs-on attribute. See the docs for more details.
Updates Fine-Grained Admin Permissions v2 documentation to clarify that certain user and group scopes also grant the ability to create users.
Changes:
- Clarified that the
managescope on users includes user creation. - Added a note explaining user-creation behavior when
manageis granted via group member permissions. - Clarified that
manage-memberson groups includes creating users into the group.
Signed-off-by: Sebastian Schuster <sebastian.schuster@bosch.com>
Signed-off-by: Sebastian Schuster <sebastian.schuster@bosch.com>
| This operation applies to any child group in the group hierarchy. | ||
| This can be prevented by explicitly denying permission for specific subgroups. | ||
| | *manage-members* | Defines if a realm administrator can manage group members. | ||
| | *manage-members* | Defines if a realm administrator can manage group members and create new users that will be members of the group. |
There was a problem hiding this comment.
The existing documentation at lines 102–105 already covers this dual requirement. The PR's new wording at line 128 is that it sounds to me that manage-members alone lets you "create new users that will be members of the group" — which some users might find incomplete. manage-members lets you create the user, but you still need manage-membership to actually place them in the group.
What about "Together with manage-membership, also allows creating new users as members of the group."?
Signed-off-by: Sebastian Schuster <sebastian.schuster@bosch.com>
d66f1af to
9aba0ec
Compare
Closes #50877