You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
New role to export Realm config without manage-realm permission for auditing?
#27383
I'm currently building a tool to automatically audit a Keycloak configuration for weaknesses and misconfigurations (I'm still putting on the finishing touches and planning to release it open source this year). For this, I am using the partial-export endpoint to pull the current configuration dump. In the current setup, I have the view-realm role, but not the manage-realm role, as the security team (rightly!) should not have write access to production.
With #24340 / KC 23, the permissions were changed so that view-realm is no longer sufficient to create an export, and I would need manage-realm to do so. As I am very unlikely to be granted manage-realm access on a production environment with millions of users (and would not want it anyway): is there any supported way of getting back realm-export rights without having manage-user rights? I.e., an export-realm role or something similar?
Discussion
No response
Motivation
Supporting the work of security teams and config auditors :)
This discussion was converted from issue #27379 on February 29, 2024 09:50.
Heading
Bold
Italic
Quote
Code
Link
Numbered list
Unordered list
Task list
Attach files
Mention
Reference
Menu
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confu
3730
sed emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Description
I'm currently building a tool to automatically audit a Keycloak configuration for weaknesses and misconfigurations (I'm still putting on the finishing touches and planning to release it open source this year). For this, I am using the partial-export endpoint to pull the current configuration dump. In the current setup, I have the view-realm role, but not the manage-realm role, as the security team (rightly!) should not have write access to production.
With #24340 / KC 23, the permissions were changed so that view-realm is no longer sufficient to create an export, and I would need manage-realm to do so. As I am very unlikely to be granted manage-realm access on a production environment with millions of users (and would not want it anyway): is there any supported way of getting back realm-export rights without having
manage-userrights? I.e., anexport-realmrole or something similar?Discussion
No response
Motivation
Supporting the work of security teams and config auditors :)
All reactions