Uploaded image for project: 'RH-SSO'
  1. RH-SSO
  2. RHSSO-1579

(7.2.x) Query Clients is possible with “query-users” role

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • Major
    • Archive - 21'
    • RH-SSO-7.2.4.GA
    • Server
    • Hide

      1. Create a new user
      2. Assign the realm-management role “query-users” to this user
      3. Get an Access Token for this user via the token endpoint (/auth/realms/<realmName>/protocol/openid-connect/token)
      4. Trigger query clients via GET /auth/admin/realms/<realmName>/clients and the Access Token of the user as authorization

      Current behavior:
      All clients are returned.

      Expected behavior:
      A HTTP 403 Forbidden is returned, as the user has no proper role (“query-clients”, “manage-clients” or “view-clients”) assigned.

      Show
      1. Create a new user 2. Assign the realm-management role “query-users” to this user 3. Get an Access Token for this user via the token endpoint (/auth/realms/<realmName>/protocol/openid-connect/token) 4. Trigger query clients via GET /auth/admin/realms/<realmName>/clients and the Access Token of the user as authorization Current behavior: All clients are returned. Expected behavior: A HTTP 403 Forbidden is returned, as the user has no proper role (“query-clients”, “manage-clients” or “view-clients”) assigned.
    • Keycloak Sprint 12, Keycloak Sprint 13

    Description

      A user, which has only the role “query-users”, should not be able to list all clients.
      First look in the source code:

      org.keycloak.services.resources.admin.ClientsResource#getClients
if (clientId == null || clientId.trim().equals("")) {
   auth.clients().requireList();

org.keycloak.services.resources.admin.permissions.ClientPermissions#canList:
root.hasAnyAdminRole();

org.keycloak.services.resources.admin.permissions.MgmtPermissions#hasAnyAdminRole
AdminRoles.ALL_REALM_ROLES

org.keycloak.models.AdminRoles
public static String[] ALL_REALM_ROLES = {CREATE_CLIENT, VIEW_REALM, VIEW_USERS, VIEW_CLIENTS, VIEW_EVENTS, VIEW_IDENTITY_PROVIDERS, VIEW_AUTHORIZATION, MANAGE_REALM, MANAGE_USERS, MANAGE_CLIENTS, MANAGE_EVENTS, MANAGE_IDENTITY_PROVIDERS, MANAGE_AUTHORIZATION, QUERY_USERS, QUERY_CLIENTS, QUERY_REALMS, QUERY_GROUPS};

      -> so it is possible to query clients if the user has one of the roles listed in the ALL_REALM_ROLES array.

      Attachments

        Issue Links

          is related to

          Bug - A problem that impairs or prevents the functions of the product. RHSSO-1700 (7.3.z) User not able to log in to admin console when using query-* roles

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Closed

          Activity

            People

              mkanis Martin Kanis
              hmlnarik@redhat.com Hynek Mlnařík
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: