From dfd10b16dcda4a78b02d357ba4642c5491a18a39 Mon Sep 17 00:00:00 2001 From: Stefan Bethke Date: Sat, 18 Jul 2026 14:14:44 +0200 Subject: [PATCH] Fix matchRole lookup to include group-inherited and composite roles (#25) getRoleMembersStream only returns users with the role assigned directly, so exported attributes silently excluded users who have matchRole via group membership. Filter all realm users with hasRole() instead, matching the resolution already used for authRole. Closes #20 Reviewed-on: https://git.hamburg.ccc.de/CCCHH/keycloak-attribute-endpoints-provider/pulls/25 --- .../AttributeEndpointsResourceProvider.java | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/attribute-endpoints-provider/src/main/java/de/ccc/hamburg/keycloak/attribute_endpoints/AttributeEndpointsResourceProvider.java b/attribute-endpoints-provider/src/main/java/de/ccc/hamburg/keycloak/attribute_endpoints/AttributeEndpointsResourceProvider.java index 8c17ec3..bd98b30 100644 --- a/attribute-endpoints-provider/src/main/java/de/ccc/hamburg/keycloak/attribute_endpoints/AttributeEndpointsResourceProvider.java +++ b/attribute-endpoints-provider/src/main/java/de/ccc/hamburg/keycloak/attribute_endpoints/AttributeEndpointsResourceProvider.java @@ -2,6 +2,7 @@ package de.ccc.hamburg.keycloak.attribute_endpoints; import java.util.Collection; import java.util.List; +import java.util.Map; import java.util.regex.Matcher; import java.util.regex.Pattern; import java.util.stream.Stream; @@ -118,7 +119,8 @@ public class AttributeEndpointsResourceProvider implements RealmResourceProvider .toList(); UserProvider userProvider = session.users(); - Stream users = userProvider.getRoleMembersStream(realm, matchRole); + Stream users = userProvider.searchForUserStream(realm, Map.of()) + .filter(user -> user.hasRole(matchRole)); List attribute_list = users .map(user -> {