Repository navigation
Introduce manage-organizations, view-organizations admin roles for Or… - #47266
Conversation
2f25bf8 to
e40bb9c
Compare
5bb4aee to
53ebe20
Compare
Unreported flaky test detectedIf the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR. org.keycloak.testsuite.model.session.UserSessionInitializerTest#testUserSessionPropagationBetweenSitesKeycloak CI - Store Model Tests |
53ebe20 to
a214c17
Compare
Unreported flaky test detectedIf the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR. org.keycloak.testsuite.model.session.UserSessionProviderModelTest#testCreateUserSessionsParallelKeycloak CI - Store Model Tests org.keycloak.testsuite.model.session.UserSessionProviderModelTest#testStreamsMarshallingKeycloak CI - Store Model Tests |
a214c17 to
5ed12ea
Compare
5ed12ea to
28ff68e
Compare
There was a problem hiding this comment.
Claude Code review:
All UI Issues in PR #47266
Bug 1 — manage-organizations-only users are invisible to the nav
PageNav.tsx:88-94 — showManage uses hasSomeAccess(..., "query-organizations", ...). Since manage-organizations is not a composite, these users have no role that matches, so the entire Manage nav group is hidden from them.
Fix: Add "manage-organizations" to hasSomeAccess.
Bug 2 — manage-organizations-only users can't see the Organizations feature
useIsFeatureEnabled.ts:34-38 — checks hasAny("manage-realm", "query-organizations"). A manage-organizations-only user has neither, so isFeatureEnabled(Feature.Organizations) returns false and the Organizations nav entry never renders.
Fix: Add "manage-organizations" to the hasAny call.
Bug 3 — manage-organizations-only users are blocked from the Edit Organization route
routes/EditOrganization.tsx:26 — access: "view-organizations". The server-side canView() explicitly accepts manage-organizations, but the UI access guard doesn't. A user with only manage-organizations gets blocked before the page even loads.
Fix: Change to access: ["view-organizations", "manage-organizations"].
All three bugs share the same root cause
manage-organizations was not wired as a composite role (unlike view-organizations → query-organizations). The UI checks were updated only for the query-organizations path, overlooking the case where someone is granted manage-organizations without the lower-privilege roles.
Stan's human thoughts: Although we do this in a lot of other places, I'm not sure if relying on composite roles is really the best solution. It's a bit brittle as we allow full editing of the roles in the UI. So if someone changes the composite structure, the UI guards will not work properly.
Maybe using composites is the best solution for now and we address this later throughout the code base? I'd really like to revamp the whole access strategy anyway.
|
@ssilvert thanks for the review! All three bugs share the same root cause and follow the same pattern:
So user having only So this isn't an oversight specific to organizations. Taking your human thought into consideration: Do we want to change the behavior now for all realm resources or do you prefer to make it organization-specific or do we address this later during the "revamp of the whole access strategy"? #48085 is related. |
28ff68e to
f982137
Compare
…ganization management Closes keycloak#45497 Closes keycloak#31641 Signed-off-by: vramik <vramik@redhat.com>
f982137 to
692f606
Compare
I guess we need to wait. I'll approve. |
…ganization management
Closes #45497
Closes #31641