Repository navigation
Conversation
7ff58ec to
cb9c84e
Compare
|
Also closes #14383 probably |
Closes keycloak#25954 Signed-off-by: trostoal <alexander.vontrostorff@dormakaba.com>
cb9c84e to
bbb92b7
Compare
|
Sorry for late review. I am wondering if this condition is really needed? As for instance you can use existing condition ClientRolesCondition, which applies when client has client role with the particular name. This allows that you can add client role to all requested clients (this role can be used purely as "marker role" to specify that particular client policy should be applied. No users need to be added to this role at all). It seems the approach based on "client role" has more flexibility and it can scale much better as in case when realm has thousands of clients and you want policy to be executed for half of them for instance, it won't scale well to have client-ids condition with thousand of client-ids explicitly named. It would be bad for both performance (iterating over 1000 client-ids in every request) as well as manageability. |
|
I am closing due no reply to my previous comment. And Client-ID condition can be replaced with |
Closes #25954