libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases 1 Packages Activity Actions

Use admin console correctly in KeycloakIdentity

Browse source 
Fixes: #29688

Signed-off-by: Hynek Mlnarik <hmlnarik@redhat.com>
This commit is contained in:
Hynek Mlnarik 2024-05-21 10:28:18 +02:00 committed by Hynek Mlnařík
parent bb5f308e1d
commit 65fcd44fe1
3 changed files with 17 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
js/apps/admin-ui/cypress/e2e/client_authorization_test.spec.ts
View file

@ -195,7 +195,7 @@ describe("Client authentication subtab", () => {
); );
}); });
describe.skip("Client authorization tab access for view-realm-authorization", () => { describe("Client authorization tab access for view-realm-authorization", () => {
const clientId = "realm-view-authz-client-" + uuid(); const clientId = "realm-view-authz-client-" + uuid();
beforeEach(async () => { beforeEach(async () => {
@ -241,11 +241,11 @@ describe("Client authentication subtab", () => {
loginPage.logIn("test-view-authz-user", "password"); loginPage.logIn("test-view-authz-user", "password");
keycloakBefore(); keycloakBefore();
sidebarPage sidebarPage.waitForPageLoad().goToRealm("realm-view-authz");
.waitForPageLoad()
.goToRealm("realm-view-authz") cy.reload();
.waitForPageLoad()
.goToClients(); sidebarPage.waitForPageLoad().goToClients();
listingPage listingPage
.searchItem(clientId, true, "realm-view-authz") .searchItem(clientId, true, "realm-view-authz")

3
rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/UIRealmsResource.java
View file

@ -52,9 +52,10 @@ public class UIRealmsResource {
)} )}
) )
public Stream<RealmNameRepresentation> getRealms() { public Stream<RealmNameRepresentation> getRealms() {
final RealmsPermissionEvaluator eval = AdminPermissions.realms(session, auth.adminAuth());
Stream<RealmNameRepresentation> realms = session.realms().getRealmsStream() Stream<RealmNameRepresentation> realms = session.realms().getRealmsStream()
.filter(realm -> { .filter(realm -> {
RealmsPermissionEvaluator eval = AdminPermissions.realms(session, auth.adminAuth());
return eval.canView(realm) || eval.isAdmin(realm); return eval.canView(realm) || eval.isAdmin(realm);
}) })
.map((RealmModel realm) -> { .map((RealmModel realm) -> {

13
services/src/main/java/org/keycloak/services/resources/admin/permissions/MgmtPermissions.java
View file

@ -97,12 +97,17 @@ class MgmtPermissions implements AdminPermissionEvaluator, AdminPermissionManage
} }
private void initIdentity(KeycloakSession session, AdminAuth auth) { private void initIdentity(KeycloakSession session, AdminAuth auth) {
if (Constants.ADMIN_CLI_CLIENT_ID.equals(auth.getToken().getIssuedFor()) final String issuedFor = auth.getToken().getIssuedFor();
|| Constants.ADMIN_CONSOLE_CLIENT_ID.equals(auth.getToken().getIssuedFor())) {
this.identity = new UserModelIdentity(auth.getRealm(), auth.getUser());
if (Constants.ADMIN_CLI_CLIENT_ID.equals(issuedFor) || Constants.ADMIN_CONSOLE_CLIENT_ID.equals(issuedFor)) {
this.identity = new UserModelIdentity(auth.getRealm(), auth.getUser());
} else { } else {
this.identity = new KeycloakIdentity(auth.getToken(), session); ClientModel client = session.clients().getClientByClientId(auth.getRealm(), issuedFor);
if (client != null && Boolean.parseBoolean(client.getAttribute(Constants.SECURITY_ADMIN_CONSOLE_ATTR))) {
this.identity = new UserModelIdentity(auth.getRealm(), auth.getUser());
} else {
this.identity = new KeycloakIdentity(auth.getToken(), session);
}
} }
} }