Hello, everyone!
We are in our last steps to implement Keycloak in the real world as our SSO solution. Right now, I’m doing some configuration checkups to limit user’s capabilities with account editing (be theirs or others).
The first question is: What does the manage-account role actually means? What actions does it allow a user to do?
Consider the scenario bellow:
In our rules, we cannot allow a user to alter their e-mail or username, except with a support ticket. We do allow password change from self-login and from people in your user group if you have the correct rights (a temporary password is generated and the update link is sent to this secondary user).
We do not want people to access Keycloak’s account page. Passwords will be reset through UPDATE_PASSWORD trigger links that redirects to KC’s change password page.
Which default roles should be included/set to allow these?
Cheers!