CCCHH/keycloak-attribute-endpoints-provider
0
0
Fork 0
Code Issues 5 Pull requests 5 Projects Releases Packages Activity Actions

Fix matchRole lookup to include group-inherited and composite roles #25

Merged
stb merged 2 commits from fix-role-membership into main 2026-07-18 14:14:44 +02:00
Conversation 1 Commits 2 Files changed 1 -3
1 changed files with 0 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit db302eebb4 - Show all commits

Remove superflous comment
All checks were successful
/ Verify (pull_request) Successful in 48s
Details
/ Verify (push) Successful in 49s
Details

Prev Next
Stefan Bethke 2026-07-18 14:13:39 +02:00
commit db302eebb4

3
attribute-endpoints-provider/src/main/java/de/ccc/hamburg/keycloak/attribute_endpoints/AttributeEndpointsResourceProvider.java
View file

@ -119,9 +119,6 @@ public class AttributeEndpointsResourceProvider implements RealmResourceProvider
.toList();
UserProvider userProvider = session.users();
// getRoleMembersStream only returns users with matchRole assigned directly; it misses
// users who have the role via group membership (incl. parent groups) or composite roles.
// hasRole() resolves the role the same way authUser.hasRole(authRole) does above.
Stream<UserModel> users = userProvider.searchForUserStream(realm, Map.of())
.filter(user -> user.hasRole(matchRole));