Description
Before reporting an issue
- I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.
Area
admin/fine-grained-permissions
Describe the bug
I'm using Keycloak 26.2.4 and was trying to figure out how to make Fine-Grained Admin Permissions (FGAP) work for Clients.
I understood that the user must have (realm-management) query-clients role besides the condition set in the Permission Policy.
I enabled FGAP and created a role based policy (view and manage a specific
| Policy Type | Custom Role | Group | Roles | Result | |||
| Role Name | Associated Roles | User member of Group | Group assigned Roles | User directly assigned Roles | User inherited Roles | ||
| Role | — | — | — |
|
— | Client and Client Scopes menus are displayed. The user can view and manage |
|
|
— | — |
|
|
Client menu is displayed. The user can view and manage |
||
|
|
— |
|
||||
| — |
|
— |
|
||||
| Group | — | — | — | — | — | ||
| — | — |
|
— |
|
Client menu is displayed. The user can view and manage |
||
| — | — | — |
|
— | Client menu is displayed. The user can view and manage |
||
Based on the above tests and results, it seems that, with role based policy, that partial evaluation is not processing the specific role group-myclient-managers inherited (indirectly assigned by composite roles or groups, i.e., cases 3 and 4) making the Client menu available, but without listing the allowed client.
The error in the 5th case is expected as the (realm-management) query-clients role wasn't assigned to the user.
Version
26.2.4
Regression
- The issue is a regression
Expected behavior
Users that have the specific role view scope) and manage (manage scope) the specific
Actual behavior
Users that have the specific role
How to Reproduce?
Check 3rd and 4th case in the bug description table.
Anything else?
No response