libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases 1 Packages Activity Actions

[KEYCLOAK-13656] - Deny request if requested scope is not associated to resource or any typed resources

Browse source
This commit is contained in:
Pedro Igor 2020-04-03 10:52:39 -03:00 committed by Stian Thorgersen
parent dacbe22d53
commit 44b489b571
2 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
services/src/main/java/org/keycloak/authorization/authorization/AuthorizationTokenService.java
View file

@ -506,6 +506,11 @@ public class AuthorizationTokenService {
if (perm == null) { if (perm == null) {
perm = Permissions.createResourcePermissions(resource, requestedScopesModel, authorization, request); perm = Permissions.createResourcePermissions(resource, requestedScopesModel, authorization, request);
//if scopes were requested, check if the permission to evaluate resolves to any of the requested scopes.
// if it is not the case, then the requested scope is invalid and we don't need to evaluate
if (!requestedScopesModel.isEmpty() && perm.getScopes().isEmpty()) {
continue;
}
permissionsToEvaluate.put(resource.getId(), perm); permissionsToEvaluate.put(resource.getId(), perm);
if (limit != null) { if (limit != null) {
limit.decrementAndGet(); limit.decrementAndGet();

7
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/client/authorization/PolicyEnforcerTest.java
View file

@ -404,6 +404,13 @@ public class PolicyEnforcerTest extends AbstractKeycloakTest {
context = policyEnforcer.enforce(httpFacade); context = policyEnforcer.enforce(httpFacade);
assertTrue(context.isGranted()); assertTrue(context.isGranted());
// create a PATCH scope without associated it with the resource so that a PATCH request is denied accordingly even though
// the scope exists on the server
clientResource.authorization().scopes().create(new ScopeRepresentation("PATCH"));
httpFacade = createHttpFacade("/api/resource-with-scope", token, "PATCH");
context = policyEnforcer.enforce(httpFacade);
assertFalse(context.isGranted());
ScopePermissionRepresentation postPermission = new ScopePermissionRepresentation(); ScopePermissionRepresentation postPermission = new ScopePermissionRepresentation();
postPermission.setName("GET permission"); postPermission.setName("GET permission");