libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases 1 Packages Activity Actions

Returning email as username setting for admins

Browse source 
Fixes #17591
This commit is contained in:
Pedro Igor 2023-03-27 11:50:16 -03:00
parent cda0c9dce0
commit a9c605750d
4 changed files with 22 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
services/src/main/java/org/keycloak/services/resources/admin/RealmAdminResource.java
View file

@ -360,6 +360,10 @@ public class RealmAdminResource {
RealmRepresentation rep = new RealmRepresentation(); RealmRepresentation rep = new RealmRepresentation();
rep.setRealm(realm.getName()); rep.setRealm(realm.getName());
if (auth.users().canView()) {
rep.setRegistrationEmailAsUsername(realm.isRegistrationEmailAsUsername());
}
if (auth.realm().canViewIdentityProviders()) { if (auth.realm().canViewIdentityProviders()) {
RealmRepresentation r = ModelToRepresentation.toRepresentation(session, realm, false); RealmRepresentation r = ModelToRepresentation.toRepresentation(session, realm, false);
rep.setIdentityProviders(r.getIdentityProviders()); rep.setIdentityProviders(r.getIdentityProviders());

2
services/src/main/java/org/keycloak/services/resources/admin/permissions/RealmPermissions.java
View file

@ -77,7 +77,7 @@ class RealmPermissions implements RealmPermissionEvaluator {
@Override @Override
public boolean canListRealms() { public boolean canListRealms() {
return canViewRealm() || root.hasOneAdminRole(AdminRoles.ALL_QUERY_ROLES); return root.isAdmin();
} }
@Override @Override

2
services/src/main/java/org/keycloak/services/resources/admin/permissions/RolePermissions.java
View file

@ -331,7 +331,7 @@ class RolePermissions implements RolePermissionEvaluator, RolePermissionManageme
if (canView(container)) { if (canView(container)) {
return true; return true;
} else if (container instanceof RealmModel) { } else if (container instanceof RealmModel) {
return root.realm().canListRealms(); return root.realm().canViewRealm() || root.hasOneAdminRole(AdminRoles.ALL_QUERY_ROLES);
} else { } else {
return root.clients().canList((ClientModel)container); return root.clients().canList((ClientModel)container);
} }

17
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/PermissionsTest.java
View file

@ -297,7 +297,22 @@ public class PermissionsTest extends AbstractKeycloakTest {
realm.toRepresentation(); realm.toRepresentation();
} }
}, Resource.REALM, false, true); }, Resource.REALM, false, true);
assertGettersEmpty(clients.get(AdminRoles.QUERY_REALMS).realm(REALM_NAME).toRepresentation());
{
RealmRepresentation realm = clients.get(AdminRoles.QUERY_REALMS).realm(REALM_NAME).toRepresentation();
assertGettersEmpty(realm);
assertNull(realm.isRegistrationEmailAsUsername());
realm = clients.get(AdminRoles.VIEW_USERS).realm(REALM_NAME).toRepresentation();
assertNotNull(realm.isRegistrationEmailAsUsername());
realm = clients.get(AdminRoles.MANAGE_USERS).realm(REALM_NAME).toRepresentation();
assertNotNull(realm.isRegistrationEmailAsUsername());
// query users only if granted through fine-grained admin
realm = clients.get(AdminRoles.QUERY_USERS).realm(REALM_NAME).toRepresentation();
assertNull(realm.isRegistrationEmailAsUsername());
}
// this should pass given that users granted with "query" roles are allowed to access the realm with limited access // this should pass given that users granted with "query" roles are allowed to access the realm with limited access
for (String role : AdminRoles.ALL_QUERY_ROLES) { for (String role : AdminRoles.ALL_QUERY_ROLES) {