Closed
Description
Before reporting an issue
- I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.
Area
admin/api
Describe the bug
The clients resource API endpoint responses with 200 OK even when I'm not allowed to use the API.
The API should behave in a consistent way. This is unexpected behaviour.
Version
26.2.5
Regression
- The issue is a regression
Expected behavior
I expect a 402 Forbidden as response when the token has no admin-role or the query-clients role.
Actual behavior
When I call with query-users role the REST API on https://SERVER/admin/realms/REALM/clients (GET) I get a status 200 OK with an empty JSON-array "[]" as response.
How to Reproduce?
- create a user with the role "query-users"
- get an access token for the user
- call
curl --location 'https://SERVER/admin/realms/REALM/clients' --header 'Authorization: Bearer ACCESS-TOKEN'
Anything else?
No response