From a7940c6ffae01aeb664493d22c3bdc9e2764cdd0 Mon Sep 17 00:00:00 2001
From: Bill Burke <bburke@redhat.com>
Date: Fri, 14 Jul 2017 18:29:48 -0400
Subject: [PATCH] KEYCLOAK-5194

---
 .../keycloak/services/resources/admin/ClientResource.java   | 6 +++---
 .../keycloak/services/resources/admin/GroupResource.java    | 4 ++--
 .../services/resources/admin/RoleContainerResource.java     | 4 ++--
 .../theme/base/admin/resources/templates/kc-menu.html       | 2 +-
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/services/src/main/java/org/keycloak/services/resources/admin/ClientResource.java b/services/src/main/java/org/keycloak/services/resources/admin/ClientResource.java
index e7d611eaeb..02063fa3e8 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/ClientResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/ClientResource.java
@@ -562,9 +562,9 @@ public class ClientResource {
     @NoCache
     public ManagementPermissionReference setManagementPermissionsEnabled(ManagementPermissionReference ref) {
         auth.clients().requireManage(client);
-         if (ref.isEnabled()) {
-            AdminPermissionManagement permissions = AdminPermissions.management(session, realm);
-            permissions.clients().setPermissionsEnabled(client, ref.isEnabled());
+        AdminPermissionManagement permissions = AdminPermissions.management(session, realm);
+        permissions.clients().setPermissionsEnabled(client, ref.isEnabled());
+        if (ref.isEnabled()) {
             return toMgmtRef(client, permissions);
         } else {
             return new ManagementPermissionReference();
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/GroupResource.java b/services/src/main/java/org/keycloak/services/resources/admin/GroupResource.java
index 3de46b0e29..0c0ed89237 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/GroupResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/GroupResource.java
@@ -263,9 +263,9 @@ public class GroupResource {
     @NoCache
     public ManagementPermissionReference setManagementPermissionsEnabled(ManagementPermissionReference ref) {
         auth.groups().requireManage(group);
+        AdminPermissionManagement permissions = AdminPermissions.management(session, realm);
+        permissions.groups().setPermissionsEnabled(group, ref.isEnabled());
         if (ref.isEnabled()) {
-            AdminPermissionManagement permissions = AdminPermissions.management(session, realm);
-            permissions.groups().setPermissionsEnabled(group, ref.isEnabled());
             return toMgmtRef(group, permissions);
         } else {
             return new ManagementPermissionReference();
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/RoleContainerResource.java b/services/src/main/java/org/keycloak/services/resources/admin/RoleContainerResource.java
index 79bb6c8f99..7ad9d2233f 100755
--- a/services/src/main/java/org/keycloak/services/resources/admin/RoleContainerResource.java
+++ b/services/src/main/java/org/keycloak/services/resources/admin/RoleContainerResource.java
@@ -364,9 +364,9 @@ public class RoleContainerResource extends RoleResource {
             throw new NotFoundException("Could not find role");
         }
 
+        AdminPermissionManagement permissions = AdminPermissions.management(session, realm);
+        permissions.roles().setPermissionsEnabled(role, ref.isEnabled());
         if (ref.isEnabled()) {
-            AdminPermissionManagement permissions = AdminPermissions.management(session, realm);
-            permissions.roles().setPermissionsEnabled(role, ref.isEnabled());
             return RoleByIdResource.toMgmtRef(role, permissions);
         } else {
             return new ManagementPermissionReference();
diff --git a/themes/src/main/resources/theme/base/admin/resources/templates/kc-menu.html b/themes/src/main/resources/theme/base/admin/resources/templates/kc-menu.html
index 53b0a3d5e7..cea1692345 100755
--- a/themes/src/main/resources/theme/base/admin/resources/templates/kc-menu.html
+++ b/themes/src/main/resources/theme/base/admin/resources/templates/kc-menu.html
@@ -50,7 +50,7 @@
         <ul class="nav nav-pills nav-stacked">
             <li data-ng-show="access.queryGroups" data-ng-class="(path[2] == 'groups'
                         || path[2] == 'default-groups') && 'active'"><a href="#/realms/{{realm.realm}}/groups"><span class="pficon pficon-users"></span> {{:: 'groups' | translate}}</a></li>
-            <li data-ng-show="access.queryUsers" data-ng-class="(path[2] == 'users') && 'active'"><a href="#/realms/{{realm.realm}}/users"><span class="pficon pficon-user"></span> {{:: 'users' | translate}}</a></li>
+            <li data-ng-show="access.queryUsers" data-ng-class="(path[2] == 'users' || path[2] == 'users-permissions') && 'active'"><a href="#/realms/{{realm.realm}}/users"><span class="pficon pficon-user"></span> {{:: 'users' | translate}}</a></li>
             <li data-ng-show="access.viewRealm" data-ng-class="(path[2] == 'sessions') && 'active'"><a href="#/realms/{{realm.realm}}/sessions/realm"><i class="fa fa-clock-o"></i> {{:: 'sessions' | translate}}</a></li>
             <li data-ng-show="access.viewEvents" data-ng-class="(path[2] == 'events' 
                         || path[2] == 'events-settings'