mirror/keycloak
1
0
Fork 0
mirror of https://github.com/keycloak/keycloak.git synced 2026-02-12 02:09:29 -06:00
Code Issues Packages Projects Releases Wiki Activity

Improve message when evaluating permission results

Browse Source 
Closes #38212

Signed-off-by: Pedro Igor <pigor.craveiro@gmail.com>
This commit is contained in:
Pedro Igor
2025-03-19 15:58:47 -03:00
committed by GitHub
parent a4000575a4
commit 76bf463de3
2 changed files with 17 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
services/src/main/java/org/keycloak/authorization/admin/representation/PolicyEvaluationResponseBuilder.java
View File

@@ -168,10 +168,22 @@ public class PolicyEvaluationResponseBuilder {
}
result.setAllowedScopes(new ArrayList<>(result.getAllowedScopes()));
result.getAllowedScopes().removeAll(result.getDeniedScopes());
if (!result.getAllowedScopes().isEmpty() && result.getAllowedScopes().stream().noneMatch(result.getScopes()::contains)) {
response.setStatus(DecisionEffect.DENY);
List<ScopeRepresentation> allowedScopes = result.getAllowedScopes();
if (AdminPermissionsSchema.SCHEMA.isAdminPermissionClient(authorization.getRealm(),resourceServer.getId())
&& allowedScopes.size() == 1
&& allowedScopes.stream().map(ScopeRepresentation::getName).anyMatch(AdminPermissionsSchema.VIEW::equals)
&& result.getScopes().stream().map(ScopeRepresentation::getName).anyMatch(AdminPermissionsSchema.VIEW::equals)) {
response.setStatus(DecisionEffect.PERMIT);
result.setDeniedScopes(new ArrayList<>(result.getDeniedScopes()));
result.getDeniedScopes().removeIf((s) -> AdminPermissionsSchema.VIEW.equals(s.getName()));
} else {
allowedScopes.removeAll(result.getDeniedScopes());
if (!result.getScopes().isEmpty() && allowedScopes.stream().noneMatch(result.getScopes()::contains)) {
response.setStatus(DecisionEffect.DENY);
}
}
if (resource.getId() != null) {
@@ -187,7 +199,7 @@ public class PolicyEvaluationResponseBuilder {
result.getDeniedScopes().addAll(model.getScopes().stream()
.map(ModelToRepresentation::toRepresentation)
.filter(Predicate.not(scopes::contains))
.filter(Predicate.not(result.getAllowedScopes()::contains))
.filter(Predicate.not(allowedScopes::contains))
.toList()
);
} else {

2
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/PolicyEvaluationCompositeRoleTest.java
View File

@@ -131,7 +131,7 @@ public class PolicyEvaluationCompositeRoleTest extends AbstractAuthzTest {
request.setClientId(resourceServerId);
request.addResource("myresource", "myscope");
PolicyEvaluationResponse result = realm.clients().get(resourceServerId).authorization().policies().evaluate(request);
Assert.assertEquals(result.getStatus(), DecisionEffect.PERMIT);
Assert.assertEquals(DecisionEffect.PERMIT, result.getStatus());
}