From f71ddbfa602da8f172aaace6f4ca4dfd0481769e Mon Sep 17 00:00:00 2001 From: mposolda Date: Mon, 13 Jun 2016 12:08:58 +0200 Subject: [PATCH] KEYCLOAK-3105 Can't access single realm with the admin user from master realm --- .../services/resources/admin/RealmsAdminResource.java | 9 +++++---- .../org/keycloak/testsuite/admin/PermissionsTest.java | 9 +++++++++ 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/services/src/main/java/org/keycloak/services/resources/admin/RealmsAdminResource.java b/services/src/main/java/org/keycloak/services/resources/admin/RealmsAdminResource.java index c6407c715a..1a9a5c316e 100755 --- a/services/src/main/java/org/keycloak/services/resources/admin/RealmsAdminResource.java +++ b/services/src/main/java/org/keycloak/services/resources/admin/RealmsAdminResource.java @@ -105,15 +105,16 @@ public class RealmsAdminResource { ClientModel adminApp = auth.getRealm().getClientByClientId(realmManager.getRealmAdminClientId(auth.getRealm())); addRealmRep(reps, auth.getRealm(), adminApp); } + + if (reps.isEmpty()) { + throw new ForbiddenException(); + } + logger.debug(("getRealms()")); return reps; } protected void addRealmRep(List reps, RealmModel realm, ClientModel realmManagementClient) { - if (!auth.hasOneOfAppRole(realmManagementClient, AdminRoles.ALL_REALM_ROLES)) { - throw new ForbiddenException(); - } - if (auth.hasAppRole(realmManagementClient, AdminRoles.VIEW_REALM)) { reps.add(ModelToRepresentation.toRepresentation(realm, false)); } else if (auth.hasOneOfAppRole(realmManagementClient, AdminRoles.ALL_REALM_ROLES)) { diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/PermissionsTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/PermissionsTest.java index 98bf9e6dea..81de89463d 100644 --- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/PermissionsTest.java +++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/PermissionsTest.java @@ -182,6 +182,15 @@ public class PermissionsTest extends AbstractKeycloakTest { Assert.assertNames(realms, REALM_NAME); assertNotNull(realms.get(0).getAccessTokenLifespan()); + // Check the same when access with users from 'master' realm + realms = clients.get("master-" + AdminRoles.VIEW_USERS).realms().findAll(); + Assert.assertNames(realms, REALM_NAME); + assertGettersEmpty(realms.get(0)); + + realms = clients.get("master-" + AdminRoles.VIEW_REALM).realms().findAll(); + Assert.assertNames(realms, REALM_NAME); + assertNotNull(realms.get(0).getAccessTokenLifespan()); + // Create realm invoke(new Invocation() { public void invoke(RealmResource realm) {