Skip to content

50877 [DOC][FGAPv2] Clarify that manage and manage-members for users allow creating users #50881

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ahus1 merged 4 commits into from
Jul 16, 2026
+3 −3
Merged

50877 [DOC][FGAPv2] Clarify that manage and manage-members for users allow creating users #50881

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
2b8ed68
50877 [DOC][FGAPv2] Clarify that manage and manage-members for users …
sschu Jul 14, 2026
1e5169e
Wording improvement
sschu Jul 14, 2026
4c825a7
Another rewording
sschu Jul 15, 2026
9aba0ec
More rewording
sschu Jul 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .../documentation/server_admin/topics/admin-console-permissions/fine-grain-v2.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,7 +87,7 @@ set of scopes:
| *Scope* | *Description* | *Also granted by*

| *view* | Defines if a realm administrator can view users. This scope should be set whenever you want to make users available from queries. | `view-members`
| *manage* | Defines if a realm administrator can manage users. | `manage-members`
| *manage* | Defines if a realm administrator can manage and create users. | `manage-members`
Comment thread
sschu marked this conversation as resolved.
| *manage-group-membership* | Defines if a realm administrator can assign or unassign users to/from groups. | `manage-membership-of-members`
| *map-roles* | Defines if a realm administrator can assign or unassign roles to/from users. | None
| *impersonate* | Defines if a realm administrator can impersonate other users. | `impersonate-members`
Expand All @@ -97,7 +97,7 @@ set of scopes:

The user resource type has a strong relationship with some of the permissions you can set to groups. Most of the time,
users are members of groups and granting access to `view-members` or `manage-members` of a group should also allow
a realm administrator to `view` and `manage` members of that group.
a realm administrator to `view` and `manage` members of that group. Note that `manage` for users includes creating new users.
Comment thread
sschu marked this conversation as resolved.

To assign or unassign a specific user to or from a group, both sides of the relationship are required: `manage-group-membership`
on the user and `manage-membership` on the target group.
Expand Down Expand Up @@ -125,7 +125,7 @@ set of management operations:
| *view-members* | Defines if a realm administrator can view group members.
This operation applies to any child group in the group hierarchy.
This can be prevented by explicitly denying permission for specific subgroups.
| *manage-members* | Defines if a realm administrator can manage group members.
| *manage-members* | Defines if a realm administrator can manage group members. Together with `manage-membership`, also allows creating new users as members of the group.
This operation applies to any child group in the group hierarchy.
This can be prevented by explicitly denying permission for specific subgroups.
| *impersonate-members* | Defines if a realm administrator can impersonate group members.
Expand Down