CCCHH/keycloak-attribute-endpoints-provider
0
0
Fork 0
Code Issues 5 Pull requests 5 Projects Releases Packages Activity Actions

Fix matchRole lookup to include group-inherited and composite roles #25

Merged
stb merged 2 commits from fix-role-membership into main 2026-07-18 14:14:44 +02:00
Conversation 1 Commits 2 Files changed 1 -3
1 changed files with 0 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit db302eebb4 - Show all commits

Remove superflous comment
All checks were successful
/ Verify (pull_request) Successful in 48s
Details
/ Verify (push) Successful in 49s
Details

Prev Next
Stefan Bethke 2026-07-18 14:13:39 +02:00
commit db302eebb4

3
attribute-endpoints-provider/src/main/java/de/ccc/hamburg/keycloak/attribute_endpoints/AttributeEndpointsResourceProvider.java
View file

@ -119,9 +119,6 @@ public class AttributeEndpointsResourceProvider implements RealmResourceProvider
.toList(); .toList();
UserProvider userProvider = session.users(); UserProvider userProvider = session.users();
// getRoleMembersStream only returns users with matchRole assigned directly; it misses
// users who have the role via group membership (incl. parent groups) or composite roles.
// hasRole() resolves the role the same way authUser.hasRole(authRole) does above.
Stream<UserModel> users = userProvider.searchForUserStream(realm, Map.of()) Stream<UserModel> users = userProvider.searchForUserStream(realm, Map.of())
.filter(user -> user.hasRole(matchRole)); .filter(user -> user.hasRole(matchRole));
stb marked this conversation as resolved Outdated
kritzl commented 2026-07-14 14:42:37 +02:00
Outdated
Copy link

this comment isn't that useful, after this PR is merged, as it references old code. Please write such information in the PR discussion

this comment isn't that useful, after this PR is merged, as it references old code. Please write such information in the PR discussion