From b292fd802362b56808daaeea0119c70e8bc91dd0 Mon Sep 17 00:00:00 2001
From: Stefan Bethke <stb@lassitu.de>
Date: Sat, 18 Jul 2026 15:01:26 +0200
Subject: [PATCH] Give a meaningful error message when the necessary role is
 missing

---
 .../attribute_endpoints/AttributeEndpointsResourceProvider.java  | 1 +
 1 file changed, 1 insertion(+)

diff --git a/attribute-endpoints-provider/src/main/java/de/ccc/hamburg/keycloak/attribute_endpoints/AttributeEndpointsResourceProvider.java b/attribute-endpoints-provider/src/main/java/de/ccc/hamburg/keycloak/attribute_endpoints/AttributeEndpointsResourceProvider.java
index bd98b30..15303dc 100644
--- a/attribute-endpoints-provider/src/main/java/de/ccc/hamburg/keycloak/attribute_endpoints/AttributeEndpointsResourceProvider.java
+++ b/attribute-endpoints-provider/src/main/java/de/ccc/hamburg/keycloak/attribute_endpoints/AttributeEndpointsResourceProvider.java
@@ -109,6 +109,7 @@ public class AttributeEndpointsResourceProvider implements RealmResourceProvider
 
         UserModel authUser = auth.getUser();
         if (!authUser.hasRole(authRole)) {
+            LOG.info("User " + authUser.getUsername() + " does not have required role " + authRole.getName());
             throw new ForbiddenException("User does not have required auth role.");
         }