Restricting users to Web Applications or device of a specific ArchiveDevice (>= 5.33.1)

[Ga Rt]

Hi everyone,

I’m using dcm4chee-arc-light 5.33.1 with Keycloak for authentication.

In the web UI, users can change the “Web App Service” from the dropdown menu (for example, between the webapps of the main device and those of another device like “extern”).  
I would like to restrict some users so that they can only see or use the webapps of one device (for example, only the “extern” device), and not be able to switch to others.

I tried to look for any option in the admin UI (like accepted roles or permissions per device), but I can’t find anything like that.  
I would prefer not to edit the LDAP schema manually.

Is there a recommended or simple way to do this in version 5.33.1?  
For example, using Keycloak roles, UI configuration, or something else?

Thanks a lot for your help,