Repository navigation
Replies: 1 comment 1 reply
|
I guess you are using a "Claim To Role" mapper? We use that functionality in a similar way, but haven't encountered such issues. So the behavior you describe is rather a bug than by design. I think it makes sense to create a ticket with a description on how to reproduce that behavior. |
|
We have six different environments. Two of those run Quarkus Keycloaks and they don't display this "odd" behaviour. Since writing the above question, I found a workaround: instead of using "Claim to Role", I use "Advanced Claim to Group" mapper. I added a group per each target role, and now the claim-to-group mapper maps an AD group to a Keycloak group that has a role defined. Also, Advanced Claim to Group/Role mappers UI in v19 is borked. I can create a mapper and save it, but after KC reloads the view, I have around 20 key-value pairs where there originally was one. I don't think I will write a bug ticket about this, since we're already planning on migrating all environments to Quarkus Keycloaks, and the team is happy with the workaround I found. |
Uh oh!
There was an error while loading. Please reload this page.
Hi,
My situation is as follows:
In our project Keycloak (still in v19) uses AD FS with OAuth to authenticate users. Upon login those users are stored in Keycloak's database. We have multiple AD groups to Keycloak client roles mappers. Along these lines:
Application X has a corresponding client X in Keycloak. In that client, we've specified roles A, B and C. We have identity provider mappers that map AD group Foo to the role
X.A, group Bar toX.B, and group Baz toX.C.We've noticed that if a group is removed from a user on AD, the user's corresponding role gets removed on Keycloak, also. That's as it should be, as we have Force Sync enabled for that particular identity provider.
But we've noticed, that if the user regains a removed AD group, the corresponding role does not get added to the user on login.
Is this a known bug, or is it by design?
All reactions