IS 7.0 Console Settings page not listing Administrators correctly

[lakshithakasun]

Description

Console Settings → Administrators page does not reliably list valid administrators, even though the underlying role assignment is correct. Reproduced on WSO2 IS 7.0.0 update levels 145.

Environment: WSO2 IS 7.0.0 (update level 145), JDBC primary user store (database_unique_id), affected UI: Console → Settings → Administrators.

Root cause: The page calls GET /scim2/Users?count=11&domain=PRIMARY&excludedAttributes=groups&startIndex=1 (first 11 PRIMARY usernames, alphabetical, no admin filter) and filters that one page client-side by each user's roles attribute.

Any admin whose username doesn't sort into the tenant's first 11 usernames overall is never fetched — never appears, regardless of correct role assignment.
A user's roles attribute only reflects direct assignment; roles inherited via group membership are never included, so group-based admins can never appear, at any position.

Steps to Reproduce

Get the Console app's Administrator role ID: GET /scim2/v2/Roles?filter=audience.value+eq+
Issue 1: Create a user directly sorting after ~11+ existing users (e.g. zzzz-test-admin), assign the Admin role directly via Console Settings UI, then check the user from the Console Settings UI — user is absent.

Issue 2: Create an early-sorting user (e.g. 0-test-admin), add it only to a group holding the role, call GET /scim2/Users/?attributes=roles,groups — groups shows the admin group but roles never includes Administrator.
Check this user via the Console Settings UI and user is absent

Early-sorting users like "0-test-admin" would appear if we directly assign the Admin role via Console Settings UI but not via a group.

Screen.Recording.2026-07-14.at.12.38.39.PM.mov

Please select the area issue is related to

Other

Version

Identity Server 7.0 update level 145

Environment Details (with versions)

No response

Developer Checklist

• [Behavioural Change] Does this change introduce a behavioral change to the product?
•  ↳ Approved by team lead
•  ↳ Label impact/behavioral-change added
• [Migration Impact] Does this change have a migration impact?
•  ↳ Migration label added (e.g., 7.2.0-migration)
•  ↳ Migration issues created and linked
• [New Configuration] Does this change introduce a new configuration?
•  ↳ Label config added
•  ↳ Configuration is properly documented