libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases 1 Packages Activity Actions

Returning email as username setting for admins

Browse source 
Fixes #17591
This commit is contained in:
Pedro Igor 2023-03-27 11:50:16 -03:00
parent cda0c9dce0
commit a9c605750d
4 changed files with 22 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
services/src/main/java/org/keycloak/services/resources/admin/RealmAdminResource.java
View file

@ -360,6 +360,10 @@ public class RealmAdminResource {
RealmRepresentation rep = new RealmRepresentation();
rep.setRealm(realm.getName());
if (auth.users().canView()) {
rep.setRegistrationEmailAsUsername(realm.isRegistrationEmailAsUsername());
}
if (auth.realm().canViewIdentityProviders()) {
RealmRepresentation r = ModelToRepresentation.toRepresentation(session, realm, false);
rep.setIdentityProviders(r.getIdentityProviders());

2
services/src/main/java/org/keycloak/services/resources/admin/permissions/RealmPermissions.java
View file

@ -77,7 +77,7 @@ class RealmPermissions implements RealmPermissionEvaluator {
@Override
public boolean canListRealms() {
return canViewRealm() || root.hasOneAdminRole(AdminRoles.ALL_QUERY_ROLES);
return root.isAdmin();
}
@Override

2
services/src/main/java/org/keycloak/services/resources/admin/permissions/RolePermissions.java
View file

@ -331,7 +331,7 @@ class RolePermissions implements RolePermissionEvaluator, RolePermissionManageme
if (canView(container)) {
return true;
} else if (container instanceof RealmModel) {
return root.realm().canListRealms();
return root.realm().canViewRealm() || root.hasOneAdminRole(AdminRoles.ALL_QUERY_ROLES);
} else {
return root.clients().canList((ClientModel)container);
}

17
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/PermissionsTest.java
View file

@ -297,7 +297,22 @@ public class PermissionsTest extends AbstractKeycloakTest {
realm.toRepresentation();
}
}, Resource.REALM, false, true);
assertGettersEmpty(clients.get(AdminRoles.QUERY_REALMS).realm(REALM_NAME).toRepresentation());
{
RealmRepresentation realm = clients.get(AdminRoles.QUERY_REALMS).realm(REALM_NAME).toRepresentation();
assertGettersEmpty(realm);
assertNull(realm.isRegistrationEmailAsUsername());
realm = clients.get(AdminRoles.VIEW_USERS).realm(REALM_NAME).toRepresentation();
assertNotNull(realm.isRegistrationEmailAsUsername());
realm = clients.get(AdminRoles.MANAGE_USERS).realm(REALM_NAME).toRepresentation();
assertNotNull(realm.isRegistrationEmailAsUsername());
// query users only if granted through fine-grained admin
realm = clients.get(AdminRoles.QUERY_USERS).realm(REALM_NAME).toRepresentation();
assertNull(realm.isRegistrationEmailAsUsername());
}
// this should pass given that users granted with "query" roles are allowed to access the realm with limited access
for (String role : AdminRoles.ALL_QUERY_ROLES) {