Manage users and roles

You can use the SENSE Portal to inspect users and change direct role assignments instead of relying on the Keycloak Admin Console. This allows for some separation of user privileges and keeps the core Keycloak realm management exposure limited. This feature requires the Orchestrator to have been configured with realm management access via its StackV service account. Additionally, this feature is only available to system admin class users.

Inspect a user

1. Open Admin Panels, select Roles, then Users. The portal Roles route includes admin?view=roles.
2. Search with Search Users, or sort by Username, Email, First, or Last. Search is client-side and matches username, email, first name, and last name. There is no active registration/approval status filter, and the current operator is absent from the list.
3. Select a user to view User Classes and Roles. User classes are displayed group/class roles. Expanded or inherited roles are shown but cannot be directly changed.

Change direct roles

Role chips allow a direct assigned role to be removed and a direct non-expanded role to be added. Do not attempt to change inherited or expanded roles directly.

Verify and recover safely

After a change, confirm the direct role chips show the intended assignment. If role reads or writes fail, stop and have the realm administrator check KEYCLOAK_ROLE_MANAGER and the service client’s listed roles. For a disabled or read-only capability, inspect the service-account roles: view-users plus view-realm is read-only, while manage-users plus manage-realm is required for full management. Do not broaden permissions as a first recovery action.