It appears that I am unable to assign group membership if a user is already a member of said group’s children. Hitting the API to establish membership returns 204, however, this does not create the association between the user and parent group.
Interestingly, if a user is a member of a parent group first and then becomes a member of a sub-group they have membership of both groups.
Has anyone got information on this behaviour?
The use case I have is to get all members of the parent group when using /{realm}/groups/{id}/members and also to be able to see user’s parent group in user’s groups using GET /{realm}/users/{id}/groups
There appear to be several undocumented elements on this part.
If we create the relam via the API we can place in the JSON the definition of groups and subgroups by assigning roles for each, we can put users with for each user the groups and roles.
if we use the API to create the groups after having created the realms, neither the subgroups nor the associated roles are injected.
we can only add groups 1 to 1 but each time we must find the id of the group created to create sub-groups.
It becomes impossible to create subgroups of subgroups.
indeed the search method always brings back the parent group of the highest level and not one of its children.
to achieve this you have to go through the whole tree to find the created subgroup and add children to it.
The same goes for assigning roles to the group and subgroups.
It seems that I add group to a user has same behavior at the interface and through the API
the interface does not allow to assign a group which has children to a user.
The documentation for an action gives the url (not always) a description and the data structure. but the latter seems “generic” and depending on the url involved only some parts are used but this is almost never described.
all this falls under my observations
and I am not at all sure of myself.
I admit that for lack of better I do by trial and error. but the results are not always very clear.
PUT /{realm}/users/{id}/groups/{id}
{“realm”:{realm},“userId”:{userid},“groupId”:{groupid}}
=> always the ids is correct But the result depends on groupid represent au group or a sub group.