CCCHH/keycloak-attribute-endpoints-provider
0
0
Fork 0
Code Issues 5 Pull requests 5 Projects Releases Packages Activity Actions

default-to-user-email #30

Open
stb wants to merge 7 commits from default-to-user-email into main
pull from: default-to-user-email
merge into: CCCHH:main
Conversation 2 Commits 7 Files changed 12 +6 -1
1 changed files with 6 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit 2c3c0a3dab - Show all commits

Fix matchRole lookup to include group-inherited and composite roles
All checks were successful
/ Verify (push) Successful in 1m8s
Details
/ Verify (pull_request) Successful in 46s
Details

Prev Next 
getRoleMembersStream only returns users with the role assigned
directly, so exported attributes silently excluded users who have
matchRole via group membership. Filter all realm users with
hasRole() instead, matching the resolution already used for authRole.
Stefan Bethke 2026-07-12 13:07:16 +02:00
commit 2c3c0a3dab

7
attribute-endpoints-provider/src/main/java/de/ccc/hamburg/keycloak/attribute_endpoints/AttributeEndpointsResourceProvider.java
View file

@ -2,6 +2,7 @@ package de.ccc.hamburg.keycloak.attribute_endpoints;
import java.util.Collection;
import java.util.List;
import java.util.Map;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import java.util.stream.Stream;
@ -118,7 +119,11 @@ public class AttributeEndpointsResourceProvider implements RealmResourceProvider
.toList();
UserProvider userProvider = session.users();
Stream<UserModel> users = userProvider.getRoleMembersStream(realm, matchRole);
// getRoleMembersStream only returns users with matchRole assigned directly; it misses
// users who have the role via group membership (incl. parent groups) or composite roles.
// hasRole() resolves the role the same way authUser.hasRole(authRole) does above.
Stream<UserModel> users = userProvider.searchForUserStream(realm, Map.of())
.filter(user -> user.hasRole(matchRole));
List<String> attribute_list = users
.map(user -> {