I’m trying to create a role that can only manage users/groups in one realm except for the "admin" user (or role-based admins).
This role should be able to create new users and assign them to specific subgroups. However, this role should not be able to modify the “admin” user or assign an ADMINISTRATOR group.
Is there any way to achieve this requirement?
When I assign manage-users permission, the role can manage users and groups but I can not exclude admin user (or can I?). When I configure fine-grained permissions, I can exclude admin user but group management is not allowed (there is only manage-group-membership permission, I’m looking for something like “manage-groups” permission which would allow to manage all subgroups).