Repository navigation
Replies: 3 comments
|
This would be a breaking change, but from a security point of view I strongly support switching it off by default. |
|
I can imagine the major reason for this setting is that it just works and people get the expected roles in their tokens. I think the usability of allowing specific roles to be delegated to a client has to be improved a lot as it is really quite hidden right now. |
|
Disabled fullScopeAllowed by default would be good for security. Here are three things which I would like to see improved, so that admins can start to maintain a set of allowed roles more easily. 1. Allow to add complete clients in addition to individual rolesWhen you start adding individual roles, the client can't introduce new ones without reconfiguration of the client at Keycloak. An Admin would rather allow all the roles defined by a client, so that a new role can be introduced more easily by developers of an application or resource server (API). 2. Bring the dedicated scope back to the client level at the admin console.The dedicated client scope should get an own tab at Client level. The entry may be removed at the list of client scopes as it can not be manged like the other ones, e.g. removing fails: 3. Consider renaming "Scope" to "Delegated Roles" and delegate roles of the same client by defaultThe setting fullScopeAllowed should be part of a client configuration aspect named "Delegated Roles". This is more specific as the term "Scope" is already used by OAuth2 and at Keycloak as "Client Scope".
|
Uh oh!
There was an error while loading. Please reload this page.
This discussion is a follow-up to the Keycloak DevDays 2025.
We had a great talk about security, and every speaker advised the audience to disable the "fullScopeAllowed" flag in clients.
As a result of the discussion, we concluded that Keycloak should support security by default and that the flag should be set to false by default.
The question is: Why is it set to true today, and what would be the consequences of changing it?
@TmmmmmR was one of the speakers. @sventorben the other one.
Would be nice to hear your thoughts on that topic.
All reactions