[keycloak-user] Authorization : Scope cannot be added to multiple permission

[Bruce Wings]

Has anyone else faced this issue?

Can someone form keycloak team confirm the behavior?

There is also a JIRA for the same:

https://issues.jboss.org/browse/KEYCLOAK-9176


On Wed, Dec 12, 2018 at 3:50 PM Bruce Wings <testoauth55 at gmail.com> wrote:

> (The configuration discussed below is done under the Authorization tab)
>
> I have created Authorization Scope. When I create 2 scope based
> permissions : *Perm1 and Perm2 *and add this scope to both, *no error is
> shown and scope is successfully added.*
>
> But when I look at the scopes at my client end, I see that only 1
> permission has that scope. (scope gets reflected in whichever permission is
> added at the end. It gets disappeared from previous permission). Is this
> the intended behavior?
>
> The way I checked the scopes is by intercepting request and obtaining
> permission list in my Java client.
>
> *KeycloakSecurityContext keycloakSecurityContext =
> (KeycloakSecurityContext)
> request.getAttribute(KeycloakSecurityContext.class.getName());*
> *AuthorizationContext authzContext =
> keycloakSecurityContext.getAuthorizationContext();*
> *List<Permission> permList = (authzContext==null) ? null :
> authzContext.getPermissions();*
> *for(Permission perm : permList) {*
> *    Set<String> scopeList = perm.getScopes();*
> *        // other stuff*
> *}*
>