Uploaded image for project: 'Red Hat build of Keycloak'
  1. Red Hat build of Keycloak
  2. RHBK-2660

Client roles won't open (Forbidden) with Fine Grained Permission (without view-clients realm-management role) [GHI#28633]

XMLWordPrintable

    • False
    • Hide

      None

      Show
      None
    • False

      Before reporting an issue

      [X] I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

      Area

      account/ui

      Describe the bug

      When Fine Grained permission is used for Client, the "Role" inside the client can NOT be opened so the Users inside the Role can be viewed.

      Version

      24.0.2

      Regression

      [X] The issue is a regression

      Expected behavior

      The "Roles" inside a Client to be accessible when Fine Grained permission is used with only "query-clients" realm-management role.

      Animated gif (with "view-clients" realm-management role. Because of the role, all Clients are visible, but the idea is to show that the Roles are accessible):
      !fine-grained-permission-roles-with-view-clients

      Actual behavior

      "Forbidden, permission needed: view-clients" warning is returned when a Client Role is attempted to be opened:
      !image

      Animated gif:
      !fine-grained-permission-roles-forbidden

      How to Reproduce?

      1. Create a user

      • Assign query-clients realm-management roles
      • Set a credentials, so you can sign in with it later
        !image

      2. Create a client

      • Create Client Role

      3. Create some test users

      • Assign the users to the Client Role(s)

      4. Set the Permission (at least view and manage) of the Client using a User Policy, assigning the first user created
      !image
      !image
      !image

      5. Sign in the security-admin-console
      http://localhost:8080/auth/admin/YOURREALMNAME/console/

      Anything else?

      The above reported was working fine with the Old UI (Keycloak 20.0.5 for example), if there is "query-users" and "view-users" or "query-users" and Fine Grained Permissions for the users enabled:
      !image

      !image

              Unassigned Unassigned
              pvlha Pavel Vlha
              Keycloak UI
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: