Repository navigation
Admin Permissions client - set decision strategy to AFFIRMATIVE #41147
Unanswered
vangeldertom
asked this question in
Q&A
Replies: 1 comment
|
Same problem here. Also it is not possible to use the API because of some restrictions added by this PR #35945 : an assertion throws an exception when trying to update the resource server. So why this REST service even does exist ? And indeed, the only (ugly) workaround is to execute this SQL : update resource_server set decision_strategy = 0 where id = 'e17fc76f-bde7-4e14-985f-e39b77d015af';And then restarting keycloak. |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Hello,
I’m setting up Admin Permissions using the new Fine-Grained Permissions v2, but I’m encountering an issue when configuring multiple permissions with different scopes on the same resource.
By default, the resource server associated with the new client
admin-permissionshas its decision strategy set to UNANIMOUS. From what I understand, that means every permission applied to the requested resource must grant access—even those whose scopes don’t match the current request. Please correct me if I’m mistaken.For example, I’ve defined two permissions protecting all User resources:
viewmanageIf a user’s grant satisfies Permission A but is denied by Permission B, the overall decision is Deny. I expected that requesting only
viewwould succeed regardless of themanagepermission. The only workaround I’ve found is manually changing the resource server’s decision strategy to AFFIRMATIVE in the database.My questions:
Thank you in advance for your help!
Best regards,
All reactions