Breadcrumbs

Grant QM Configurations Manage Access in Keycloak

Grant QM Configurations Manage Access in Keycloak

By default, the admin role can open and edit the Configuration screen under Quality Management in Unified Admin. A user with the quality-manager role can already open that screen in view-only mode.

View access is already included with quality-manager. This guide adds manage access on top of that view, by adding the quality-manager role to the Configurations authorization policy in Keycloak.

This is a standalone configuration guide. It does not change the default Quality Management IAM setup. Follow it only when quality-manager must change Configuration settings, not only view them.

What this changes

Keycloak Authorization Services use this hierarchy:

  • Resource and scope: quality-management with scope configurations-manage.

  • Permission: links that resource/scope to one or more policies (for example, configurations - quality-management - configurations-manage - permission).

  • Policy: defines which roles are allowed. By default, configurations - quality-management - configurations-manage - policy includes the admin role. This guide adds quality-manager so that role can manage configuration.

After you finish, users with the quality-manager role can edit Configuration under Quality Management in Unified Admin. Leave the admin role on the policy.

Step 1: Access Keycloak

  1. Open the Keycloak Administration Console in your browser: https://<FQDN>/auth.

  2. Click Administration Console.

  3. Log in with an admin account. The default username and password are admin / admin unless your environment uses different credentials.

image-20261007-114503.png

Step 2: Select the correct realm

Keycloak opens the Master realm by default. Configuration policies live in the tenant realm.

  1. Click the realm dropdown in the top-left corner.

  2. Select the tenant realm. In most Expertflow deployments this is Expertflow.

Step 3: Open the cim client

  1. In the left sidebar, click Clients.

  2. From the client list, click cim.

image-20261007-114554.png

Step 4: Add the role to the Configurations policy

  1. Stay on the cim client and open Authorization → Policies.

  2. Open the policy named configurations - quality-management - configurations-manage - policy.

  3. Click Add roles.

  4. Select the quality-manager realm role.

  5. Confirm Logic is set to Positive.

  6. Click Assign.

  7. Click Save.

image-20261007-114733.png

Step 5: Verify access

  1. Log out of Unified Admin if you are already signed in as that user.

  2. Log in with a user who has the quality-manager role.

  3. Open Quality Management → Configuration.

  4. Change a setting and save it. Confirm the change is stored.

If Configuration is still view-only, the user may need to sign out and sign in again so Keycloak issues a new token with the updated permissions.

Troubleshooting

  • Quality Manager can open Configuration but cannot save changes: Confirm quality-manager is assigned on configurations - quality-management - configurations-manage - policy, then sign out and sign in again. Viewing Configuration is already available to quality-manager. This policy adds manage access on top of that view.

  • Wrong realm: Confirm you are in the Expertflow/tenant realm, not Master.

  • Admin lost access: Confirm the admin role is still on the policy.