Fix matchRole lookup to include group-inherited and composite roles #25

stb · 2026-07-12T13:08:19+02:00

stb commented

2026-07-12 13:08:19 +02:00

getRoleMembersStream only returns users with the role assigned
directly, so exported attributes silently excluded users who have
matchRole via group membership. Filter all realm users with
hasRole() instead, matching the resolution already used for authRole.

Closes #20

getRoleMembersStream only returns users with the role assigned directly, so exported attributes silently excluded users who have matchRole via group membership. Filter all realm users with hasRole() instead, matching the resolution already used for authRole. Closes #20

stb added 1 commit

2026-07-12 13:08:19 +02:00

Fix matchRole lookup to include group-inherited and composite roles

/ Verify (push) Successful in 1m8s

Details

/ Verify (pull_request) Successful in 46s

Details

2c3c0a3dab

getRoleMembersStream only returns users with the role assigned
directly, so exported attributes silently excluded users who have
matchRole via group membership. Filter all realm users with
hasRole() instead, matching the resolution already used for authRole.

stb requested reviews from june, kritzl, lilly

2026-07-12 13:08:32 +02:00

kritzl requested changes

2026-07-14 14:42:40 +02:00

attribute-endpoints-provider/src/main/java/de/ccc/hamburg/keycloak/attribute_endpoints/AttributeEndpointsResourceProvider.java Outdated

					
				@ -121,1 +122,3 @@

				        Stream<UserModel> users = userProvider.getRoleMembersStream(realm, matchRole);

				        // getRoleMembersStream only returns users with matchRole assigned directly; it misses

				        // users who have the role via group membership (incl. parent groups) or composite roles.

				        // hasRole() resolves the role the same way authUser.hasRole(authRole) does above.