Add Client resource type and scopes to authorization schema - #6
Add Client resource type and scopes to authorization schema#6ShashankFC wants to merge 1 commit into
Conversation
…valuation implementation for ClientsPermissionsV2 Closes #35564 Signed-off-by: Martin Kanis <mkanis@redhat.com>
|
bugbot run |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
| } | ||
| }); | ||
|
|
||
| return granted; |
There was a problem hiding this comment.
getClientsWithPermission won't find individual client resources
Medium Severity
getClientsWithPermission calls resourceStore.findByType(server, "Clients", ...), but individual client resources created by getOrCreateResource never have their type set (no resource.setType(resourceType) call). Only the "all-clients" type-level resource (named "Clients") has type "Clients". So this method can never return individual client IDs — it either returns an empty set or a set containing the string "Clients", which is not a valid client ID. Callers like AvailableRoleMappingResource.getRoleIdsWithPermissions pass these to realm.getClientById(cid), which would return null and cause an NPE.
Additional Locations (1)
| return attributes; | ||
| } | ||
| }; | ||
| } |
There was a problem hiding this comment.
Unused private method getEvaluationContext is dead code
Low Severity
The private method getEvaluationContext is never called anywhere in ClientPermissionsV2. It appears to have been copied from the parent class's canExchangeTo method, but canExchangeTo in V2 throws UnsupportedOperationException. This dead code also pulls in several unused imports (Scope, EvaluationContext, TOKEN_EXCHANGE, etc.).
2 participants
Test 5nnn## Summary by CodeRabbitnn## Release Notesnn* New Featuresn * Added fine-grained authorization support for client management operations with granular permission scopes including configure, manage, view, and role mapping capabilities.n * Administrators can now assign detailed access controls for client and client scope operations, enabling better permission delegation and compliance.nn✏️ Tip: You can customize this high-level summary in your review settings.nnn---nReplicated from ai-code-review-evaluation/keycloak-coderabbit#5
Note
High Risk
Touches admin authorization/permission evaluation for client management, which is security-critical; incorrect scope evaluation could over- or under-grant access even though it is feature-flagged for FGAP v2.
Overview
Adds a new
Clientsresource type to the admin-permissions authorization schema, introducing client-specific scopes (configure,manage,view, and role-mapping variants) and the ability to resolve/create authz resources for client IDs.Implements FGAP v2 client permission evaluation via new
ClientPermissionsV2, wires it intoMgmtPermissionsV2, and expands the test suite to cover per-client vs all-clients permissions, configure/manage/view behavior, and role-mapping/composite role scenarios. Listener cleanup logic is also gated behind theADMIN_FINE_GRAINED_AUTHZfeature flag.Written by Cursor Bugbot for commit 7e55408. Configure here.