libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases Packages Activity Actions

Don't use no-arg version of GroupModel.getSubGroupsStream() when fetching the subgroups from the GroupResource endpoint.

Browse source 
- prevents pre-loading all groups; instead use the stream from the JPA adapter to load subgroups one by one and then filter based on the user permissions.

Closes #28935

Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
This commit is contained in:
Stefan Guilhen 2024-04-19 15:20:19 -03:00 committed by Pedro Igor
parent 8ca4bc77a1
commit f1532565b6
2 changed files with 4 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
model/jpa/src/main/java/org/keycloak/models/jpa/GroupAdapter.java
View file

@ -144,7 +144,6 @@ public class GroupAdapter implements GroupModel , JpaModel<GroupEntity> {
.map(realm::getGroupById)
// In concurrent tests, the group might be deleted in another thread, therefore, skip those null values.
.filter(Objects::nonNull)
.sorted(GroupModel.COMPARE_BY_NAME)
);
}

8
services/src/main/java/org/keycloak/services/resources/admin/GroupResource.java
View file

@ -164,10 +164,10 @@ public class GroupResource {
@QueryParam("briefRepresentation") @DefaultValue("false") Boolean briefRepresentation) {
this.auth.groups().requireView(group);
boolean canViewGlobal = auth.groups().canView();
return paginatedStream(
group.getSubGroupsStream()
.filter(g -> canViewGlobal || auth.groups().canView(g)), first, max)
.map(g -> GroupUtils.populateSubGroupCount(g, GroupUtils.toRepresentation(auth.groups(), g, !briefRepresentation)));
return paginatedStream(group.getSubGroupsStream(-1, -1)
.filter(g -> canViewGlobal || auth.groups().canView(g))
.map(g -> GroupUtils.populateSubGroupCount(g, GroupUtils.toRepresentation(auth.groups(), g, !briefRepresentation)))
, first, max);
}
/**