keycloak - Keycloak - how to implement delegated administration

Question

I need to implement user hierarchy using keycloak and I was wondering if someone has done it before or perhaps can give me some pointers on different ways.

In our scenario we have

• single application to protect with open-id connect
• 1 single super-admin ( realm admin)
• many team admins ( created by the super admin ) who can only administer users who belong to the same team as themselves
• ordenary users who belong to a given team and created by the team admin

Is there a way to achieve this using keycloak's authorization?

Shall I build a Custom REST endpoint in keycloak to implement this?

Shall I create groups / team perhaps ?

I am not sure what is the easiest route. I would like implement the easiest solution.

标签： keycloak