<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 24/02/16 11:26, Thomas Darimont
wrote:<br>
</div>
<blockquote
cite="mid:CAK-7U1h6vqF13am0STuQEVgatXEZN_0sjfRP1A-+BKCfDiTE_Q@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>Steps to reproduce:</div>
<div><br>
</div>
<div>create client A with client id "client-a" with a newly
defined role "user"</div>
<div>create client B with client id "client-b" with a newly
defined role "user"</div>
<div><br>
</div>
<div>create user A with <span class="" id=":5as.1"
tabindex="-1">username</span> "user-a" with "user" role
granted for "client-a"</div>
<div>create user B with <span class="" id=":5as.2"
tabindex="-1">username</span> "user-b" with "user" role
granted for "client-b"</div>
<div><br>
</div>
<div><span class="" id=":5as.3" tabindex="-1">Goto</span>
applications tab in account page:</div>
<div><a class="moz-txt-link-freetext" href="http://">http://</a><span class="" id=":5as.4" tabindex="-1">localhost</span>:8082/<span
class="" id=":5as.5" tabindex="-1">auth</span>/realms/<span
class="" id=":5as.6" tabindex="-1">eurodata</span>.local/account/applications</div>
<div><br>
</div>
<div><span class="" id=":5as.7" tabindex="-1">login</span> as
user-a</div>
<div><br>
</div>
<div>Actual: The listing shows both applications client-a AND
client-b </div>
<div> although the user-a only has a user-role to
client-a.</div>
<div>Expected: Only client-a (+ account) applications should be
shown</div>
</div>
</blockquote>
So "client-a" and "client-b" have fullScopeAllowed on? If yes, then
the current behaviour is correct IMO. The thing is that user-a is
able to login to application "client-b" and retrieve the accessToken
for "client-b". And this accessToken will contain "user" role to
"client-a" because of fullScopeAllowed.<br>
<br>
<br>
The scope is used to limit the roles, which will user see after
retrieve accessToken for particular client. So for example if you
limit scope to client-a, then accessToken for user-a to client-b
won't contain "user" role of "client-a". But if you retrieve
accessToken for client-a, it will contain it.<br>
<br>
Since the user-a doesn't have role "user" for "client-b" you will
never see this role in any access token. So current behaviour is
correct to me.<br>
<br>
Marek<br>
<br>
<br>
<blockquote
cite="mid:CAK-7U1h6vqF13am0STuQEVgatXEZN_0sjfRP1A-+BKCfDiTE_Q@mail.gmail.com"
type="cite">
<div dir="ltr">
<div><span class="" id=":5as.8" tabindex="-1">logout</span></div>
<div><br>
</div>
<div><span class="" id=":5as.9" tabindex="-1">login</span> as
user-b</div>
<div><br>
</div>
<div>Actual: The listing shows both applications client-a and
client-b </div>
<div> although the user-b only has a user-role to
client-b.</div>
<div>Expected: Only client-b (+ account) applications should be
shown</div>
<div><br>
</div>
<div>By default a client has the "Full Scope Allowed" switch set
to "on".</div>
<div>Changing this switch to "off" and explicitly assigning the
client role "user" to "client-a" </div>
<div>in the scope settings for client-a and to the user role for
client-b in the scope settings </div>
<div>for client-b solves the issue.</div>
<div><br>
</div>
<div>With this setting only the applications for which a user
actually has the "user" role is shown.</div>
<div><br>
</div>
<div>Even though the help text for "Full Scope Allowed" says:
"Allows you to disable all restrictions"</div>
<div>one would expect that "Full Scope Allowed" set to "on"
would honor the assigned roles.</div>
<div><br>
</div>
<div>Is there something wrong here or should the help text be
more descriptive?</div>
<div>I think the piece of code that does this is: org.<span
class="" id=":5as.11" tabindex="-1">keycloak</span>.protocol.<span
class="" id=":5as.12" tabindex="-1">oidc</span>.<span
class="" id=":5as.13" tabindex="-1">TokenManager</span>.<span
class="" id=":5as.14" tabindex="-1">getAccess</span>(String,
<span class="" id=":5as.15" tabindex="-1">boolean</span>, <span
class="" id=":5as.16" tabindex="-1">ClientModel</span>, <span
class="" id=":5as.17" tabindex="-1">UserModel</span>)</div>
<div><br>
</div>
<div>Cheers,</div>
<div>Thomas</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
keycloak-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:keycloak-dev@lists.jboss.org">keycloak-dev@lists.jboss.org</a>
<a class="moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/keycloak-dev">https://lists.jboss.org/mailman/listinfo/keycloak-dev</a></pre>
</blockquote>
<br>
</body>
</html>