Repository navigation
Treat the admin-permissions client as an internal client - #53883
Merged
pedroigor merged 1 commit intoOct 14, 2026
Merged
Conversation
Closes keycloak#51630 Co-authored-by: waterWang <waterwang@users.noreply.github.com> Signed-off-by: vramik <vramik@redhat.com>
This was referenced Oct 12, 2026
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The focused authorization fix addresses the reported inconsistency and includes suitable regression tests and upgrade documentation.
0 open findings
What changed in this PR
Treats the FGAP V2 admin-permissions client as internal, preventing delegated or full administrators from modifying it through client APIs.
Changes:
- Adds the client to internal-client authorization checks.
- Adds regression coverage for update, rename, and deletion attempts.
- Documents the resulting HTTP 403 behavior.
| File | Description |
|---|---|
services/.../ClientPermissions.java |
Marks the realm’s admin-permissions client as internal. |
tests/.../PermissionRESTTest.java |
Verifies full-admin updates and deletion are forbidden. |
tests/.../ClientResourceTypeEvaluationTest.java |
Verifies FGAP client-manage permission cannot modify it. |
rest/admin-v2/.../ClientApiV2AuthorizationTest.java |
Updates V2 deletion expectations to HTTP 403. |
docs/.../changes-27_0_0.adoc |
Documents the authorization change. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
martin-kanis
approved these changes
Oct 13, 2026
martin-kanis
left a comment
Member
There was a problem hiding this comment.
@vramik Thanks. The fix and test(s) looks good to me.
pedroigor
approved these changes
Oct 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #51630