From ddadd13546f179cef54de343f6c6bb1d9235323a Mon Sep 17 00:00:00 2001 From: Gaurav Dubey Date: Sat, 11 Jul 2026 23:34:20 +0530 Subject: [PATCH] Honor configured admin realm in ClientManager.isInternalClient isInternalClient hardcoded the literal "master" realm name when deciding whether a realm is the admin realm. On servers configured with an alternative admin realm (Config.getAdminRealm()), the per-realm internal admin-container clients (-realm) were not recognised as internal and could be deleted. Use Config.getAdminRealm() instead, matching the admin-realm idiom used throughout the codebase. Behaviour is unchanged on the default master realm. Signed-off-by: Gaurav Dubey --- .../java/org/keycloak/services/managers/ClientManager.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/services/src/main/java/org/keycloak/services/managers/ClientManager.java b/services/src/main/java/org/keycloak/services/managers/ClientManager.java index 6bbaafadea36..381130e21f0b 100644 --- a/services/src/main/java/org/keycloak/services/managers/ClientManager.java +++ b/services/src/main/java/org/keycloak/services/managers/ClientManager.java @@ -26,6 +26,7 @@ import java.util.TreeSet; import java.util.stream.Collectors; +import org.keycloak.Config; import org.keycloak.authentication.ClientAuthenticator; import org.keycloak.authentication.ClientAuthenticatorFactory; import org.keycloak.common.Profile; @@ -415,7 +416,7 @@ private Map getClientCredentialsAdapterConfig(ClientModel client private boolean isInternalClient(String realmName, String clientId) { if (defaultClients.contains(clientId)) return true; - if (!"master".equals(realmName)) { + if (!Config.getAdminRealm().equals(realmName)) { return false; }