From 2b8ed68f7dc5cb5afa428d1126ef6fe9d8a2a37e Mon Sep 17 00:00:00 2001 From: Sebastian Schuster Date: Tue, 14 Jul 2026 16:04:06 +0200 Subject: [PATCH 1/4] 50877 [DOC][FGAPv2] Clarify that manage and manage-members for users allow creating users Signed-off-by: Sebastian Schuster --- .../topics/admin-console-permissions/fine-grain-v2.adoc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/documentation/server_admin/topics/admin-console-permissions/fine-grain-v2.adoc b/docs/documentation/server_admin/topics/admin-console-permissions/fine-grain-v2.adoc index 6f333755a42c..d48af6bced10 100644 --- a/docs/documentation/server_admin/topics/admin-console-permissions/fine-grain-v2.adoc +++ b/docs/documentation/server_admin/topics/admin-console-permissions/fine-grain-v2.adoc @@ -87,7 +87,7 @@ set of scopes: | *Scope* | *Description* | *Also granted by* | *view* | Defines if a realm administrator can view users. This scope should be set whenever you want to make users available from queries. | `view-members` -| *manage* | Defines if a realm administrator can manage users. | `manage-members` +| *manage* | Defines if a realm administrator can manage and create users. | `manage-members` | *manage-group-membership* | Defines if a realm administrator can assign or unassign users to/from groups. | `manage-membership-of-members` | *map-roles* | Defines if a realm administrator can assign or unassign roles to/from users. | None | *impersonate* | Defines if a realm administrator can impersonate other users. | `impersonate-members` @@ -97,7 +97,7 @@ set of scopes: The user resource type has a strong relationship with some of the permissions you can set to groups. Most of the time, users are members of groups and granting access to `view-members` or `manage-members` of a group should also allow -a realm administrator to `view` and `manage` members of that group. +a realm administrator to `view` and `manage` members of that group. Note that `manage` for users includes creating new users. To assign or unassign a specific user to or from a group, both sides of the relationship are required: `manage-group-membership` on the user and `manage-membership` on the target group. @@ -125,7 +125,7 @@ set of management operations: | *view-members* | Defines if a realm administrator can view group members. This operation applies to any child group in the group hierarchy. This can be prevented by explicitly denying permission for specific subgroups. -| *manage-members* | Defines if a realm administrator can manage group members. +| *manage-members* | Defines if a realm administrator can manage group members and create new users as a member of the group. This operation applies to any child group in the group hierarchy. This can be prevented by explicitly denying permission for specific subgroups. | *impersonate-members* | Defines if a realm administrator can impersonate group members. From 1e5169e76456b28e6bc2ba15a28dc1aa3756b24a Mon Sep 17 00:00:00 2001 From: Sebastian Schuster Date: Tue, 14 Jul 2026 16:28:12 +0200 Subject: [PATCH 2/4] Wording improvement Signed-off-by: Sebastian Schuster --- .../topics/admin-console-permissions/fine-grain-v2.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/documentation/server_admin/topics/admin-console-permissions/fine-grain-v2.adoc b/docs/documentation/server_admin/topics/admin-console-permissions/fine-grain-v2.adoc index d48af6bced10..fde9fedd3b66 100644 --- a/docs/documentation/server_admin/topics/admin-console-permissions/fine-grain-v2.adoc +++ b/docs/documentation/server_admin/topics/admin-console-permissions/fine-grain-v2.adoc @@ -125,7 +125,7 @@ set of management operations: | *view-members* | Defines if a realm administrator can view group members. This operation applies to any child group in the group hierarchy. This can be prevented by explicitly denying permission for specific subgroups. -| *manage-members* | Defines if a realm administrator can manage group members and create new users as a member of the group. +| *manage-members* | Defines if a realm administrator can manage group members and create new users in the group. This operation applies to any child group in the group hierarchy. This can be prevented by explicitly denying permission for specific subgroups. | *impersonate-members* | Defines if a realm administrator can impersonate group members. From 4c825a70df19a4ecd601900602997348a8b48a47 Mon Sep 17 00:00:00 2001 From: Sebastian Schuster Date: Wed, 15 Jul 2026 21:29:05 +0200 Subject: [PATCH 3/4] Another rewording Signed-off-by: Sebastian Schuster --- .../topics/admin-console-permissions/fine-grain-v2.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/documentation/server_admin/topics/admin-console-permissions/fine-grain-v2.adoc b/docs/documentation/server_admin/topics/admin-console-permissions/fine-grain-v2.adoc index fde9fedd3b66..b56ef4717d06 100644 --- a/docs/documentation/server_admin/topics/admin-console-permissions/fine-grain-v2.adoc +++ b/docs/documentation/server_admin/topics/admin-console-permissions/fine-grain-v2.adoc @@ -125,7 +125,7 @@ set of management operations: | *view-members* | Defines if a realm administrator can view group members. This operation applies to any child group in the group hierarchy. This can be prevented by explicitly denying permission for specific subgroups. -| *manage-members* | Defines if a realm administrator can manage group members and create new users in the group. +| *manage-members* | Defines if a realm administrator can manage group members and create new users that will be members of the group. This operation applies to any child group in the group hierarchy. This can be prevented by explicitly denying permission for specific subgroups. | *impersonate-members* | Defines if a realm administrator can impersonate group members. From 9aba0ecf87410aca537fa624c1564656b4396b1b Mon Sep 17 00:00:00 2001 From: Sebastian Schuster Date: Thu, 16 Jul 2026 16:02:24 +0200 Subject: [PATCH 4/4] More rewording Signed-off-by: Sebastian Schuster --- .../topics/admin-console-permissions/fine-grain-v2.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/documentation/server_admin/topics/admin-console-permissions/fine-grain-v2.adoc b/docs/documentation/server_admin/topics/admin-console-permissions/fine-grain-v2.adoc index b56ef4717d06..fed0191c2832 100644 --- a/docs/documentation/server_admin/topics/admin-console-permissions/fine-grain-v2.adoc +++ b/docs/documentation/server_admin/topics/admin-console-permissions/fine-grain-v2.adoc @@ -125,7 +125,7 @@ set of management operations: | *view-members* | Defines if a realm administrator can view group members. This operation applies to any child group in the group hierarchy. This can be prevented by explicitly denying permission for specific subgroups. -| *manage-members* | Defines if a realm administrator can manage group members and create new users that will be members of the group. +| *manage-members* | Defines if a realm administrator can manage group members. Together with `manage-membership`, also allows creating new users as members of the group. This operation applies to any child group in the group hierarchy. This can be prevented by explicitly denying permission for specific subgroups. | *impersonate-members* | Defines if a realm administrator can impersonate group members.