-
Bug
-
Resolution: Done
-
Undefined
-
None
-
False
-
-
False
-
-
Before reporting an issue
[X] I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.
Area
account/ui
Describe the bug
When Fine Grained permission is used for Client, the "Role" inside the client can NOT be opened so the Users inside the Role can be viewed.
Version
24.0.2
Regression
[X] The issue is a regression
Expected behavior
The "Roles" inside a Client to be accessible when Fine Grained permission is used with only "query-clients" realm-management role.
Animated gif (with "view-clients" realm-management role. Because of the role, all Clients are visible, but the idea is to show that the Roles are accessible):
!fine-grained-permission-roles-with-view-clients
Actual behavior
"Forbidden, permission needed: view-clients" warning is returned when a Client Role is attempted to be opened:
!image
Animated gif:
!fine-grained-permission-roles-forbidden
How to Reproduce?
1. Create a user
- Assign query-clients realm-management roles
- Set a credentials, so you can sign in with it later
!image
2. Create a client
- Create Client Role
3. Create some test users
- Assign the users to the Client Role(s)
4. Set the Permission (at least view and manage) of the Client using a User Policy, assigning the first user created
!image
!image
!image
5. Sign in the security-admin-console
http://localhost:8080/auth/admin/YOURREALMNAME/console/
Anything else?
The above reported was working fine with the Old UI (Keycloak 20.0.5 for example), if there is "query-users" and "view-users" or "query-users" and Fine Grained Permissions for the users enabled:
!image
- links to