Indirect Role Assignment is not handled correctly #20

New issue

Closed

opened 2026-05-31 21:53:19 +02:00 by lilly · 4 comments

lilly commented

2026-05-31 21:53:19 +02:00

Owner

When using the attribute provider, one must configure a Match Role for the endpoint. Only users who have that role are considered valid for having their user attribute exported.
This check however only functions correctly when a user is directly assigned to a role. If a user is in a group and that group has the role, the check seems to fail because I observe that my user attribute is not included in the export.

user lilly -> role dooris-access (works)
user lilly -> group intern@ -> role dooris-access (does not work)

When using the attribute provider, one must configure a *Match Role* for the endpoint. Only users who have that role are considered valid for having their user attribute exported. This check however only functions correctly when a user is directly assigned to a role. If a user is in a group and that group has the role, the check seems to fail because I observe that my user attribute is not included in the export. ``` user lilly -> role dooris-access (works) user lilly -> group intern@ -> role dooris-access (does not work) ```

stb commented

2026-07-11 09:32:11 +02:00

Owner

Interestingly, as admin I can see the mailing list address attributes for my user, but logged in as myself, I do not see them. Not sure if this is the same issue, or something else.

kritzl commented

2026-07-12 12:10:26 +02:00

Member

@lilly I'll look into that

kritzl commented

2026-07-12 12:12:06 +02:00

Member

@stb wrote in #20 (comment):

Interestingly, as admin I can see the mailing list address attributes for my user, but logged in as myself, I do not see them. Not sure if this is the same issue, or something else.

When you say "I can see": Do you mean via the endpoints-provider api endpoint or the Keycloak UI?
The endpoint works only for a user, that has the configured Auth Role

@stb wrote in https://git.hamburg.ccc.de/CCCHH/keycloak-attribute-endpoints-provider/issues/20#issuecomment-5434: > Interestingly, as admin I can see the mailing list address attributes for my user, but logged in as myself, I do not see them. Not sure if this is the same issue, or something else. When you say "I can see": Do you mean via the endpoints-provider api endpoint or the Keycloak UI? The endpoint works only for a user, that has the configured `Auth Role`

stb commented

2026-07-12 12:40:19 +02:00

Owner

@kritzl wrote in #20 (comment):

@stb wrote in #20 (comment):

Interestingly, as admin I can see the mailing list address attributes for my user, but logged in as myself, I do not see them. Not sure if this is the same issue, or something else.

When you say "I can see": Do you mean via the endpoints-provider api endpoint or the Keycloak UI? The endpoint works only for a user, that has the configured Auth Role

My mistake, the attribute visibility was configured to only show the attribute to admins (which the user stb is not).

@kritzl wrote in https://git.hamburg.ccc.de/CCCHH/keycloak-attribute-endpoints-provider/issues/20#issuecomment-5514: > @stb wrote in #20 (comment): > > > Interestingly, as admin I can see the mailing list address attributes for my user, but logged in as myself, I do not see them. Not sure if this is the same issue, or something else. > > When you say "I can see": Do you mean via the endpoints-provider api endpoint or the Keycloak UI? The endpoint works only for a user, that has the configured `Auth Role` My mistake, the attribute visibility was configured to only show the attribute to admins (which the user stb is not).

stb referenced this issue from a pull request that will close it,

2026-07-12 13:08:19 +02:00

Fix matchRole lookup to include group-inherited and composite roles #25

stb closed this issue

2026-07-18 14:14:44 +02:00

stb referenced this issue from a commit

2026-07-18 14:14:45 +02:00

Fix matchRole lookup to include group-inherited and composite roles (#25)