Authorization using decision response_mode giving incorrect data

[mnsudhan86]

Before reporting an issue

• I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

authorization-services

Describe the bug

This is w.r.t https://www.keycloak.org/docs/25.0.0/authorization_services/#_service_obtaining_permissions.

I have created following for my authorization model.

• 2 Resources - Resource1 & Resource2
• 2 authorization scopes - "view" and "manage"
• 2 Roles - Role1 & Role2

I have created 2 role based policies "Policy1" & "Policy2" each specific to "Role1" & "Role2" respectively.
I have created 2 scope based permissions as follows.

• Policy1_view_all_resources -> This to provide "view" access on both "Resource1" & "Resource2" to "Role1"
• Policy2_manage_resource1 -> This to provide "manage" access on only "Resource1" to "Role2".

I have a user created called "testuser" who is associated with both "Role1" & "Role2". Expectation is that "testuser" is allowed "view" access on both "Resource1" & "Resource2" but is allowed "manage" access on only "Resource1".

When I query keycloak authorization, with following data

grant_type: "urn:ietf:params:oauth:grant-type:uma-ticket"
audience: "shared-client"
response_mode: "decision"
permission: "Resource2#manage"

I get correct response as below which is on expected lines as "testuser" do not have "manage" access on "Resource2"

{
"error": "access_denied",
"error_description": "not_authorized"
}

But when do a query on both resources for "manage" access, I see that keycloak authorization service is giving incorrect output.

grant_type: "urn:ietf:params:oauth:grant-type:uma-ticket"
audience: "shared-client"
response_mode: "decision"
permission: "Resource1#manage"
permission: "Resource2#manage"

Response from keycloak is as below

{
"result": true
}

which is not correct, as "testuser" do not have "manage" access on "Resource2".

Can someone please have a look at this?

Version

24

Regression

• The issue is a regression

Expected behavior

Keycloak authorization service should return "access_denied" when user is not having access to few resources.

Actual behavior

Keycloak authorization service returns "true" even if user is not having access to few resources.

How to Reproduce?

Steps provided in description

Anything else?

No response

[mnsudhan86]

Hi,

I have tested the same configuration on Keycloak 25.0.1 and see the same behaviour there too.

User is not allowed "manage" access on "Resource2".

With only below body, it works fine.

Request body:
grant_type: "urn:ietf:params:oauth:grant-type:uma-ticket"
audience: "authz-client"
response_mode: "decision"
permission: "Resource2#manage"

Response:
{
"error": "access_denied",
"error_description": "not_authorized"
}

However, when trying to check for both resources as shown below, it gives incorrect result.

Request body:

grant_type: "urn:ietf:params:oauth:grant-type:uma-ticket"
audience: "authz-client"
response_mode: "decision"
permission: "Resource1#manage"
permission: "Resource2#manage"

Response:
{"result":true}

[jonkoops]

Thanks for confirming that @mnsudhan86

[pedroigor]

@mnsudhan86 Can you please check the permissions actually granted by changing response_mode to permissions?

The decision response mode should indicate if any of the requested permissions were granted.

[mnsudhan86]

Hi @pedroigor

I changed response_mode to permissions and below is the result.

[
{
"scopes": [
"manage"
],
"rsid": "d0c55b95-715b-43d2-bef3-0b8ef71c981b",
"rsname": "Resource1"
}
]

It correctly shows that user has "manage" access to only "Resource1".

Below was my request body.

grant_type: "urn:ietf:params:oauth:grant-type:uma-ticket"
audience: "shared-client"
response_mode: "permissions"
permission: "Resource1#manage"
permission: "Resource2#manage"

[pedroigor]

Thanks, for trying it out. The behavior is expected.

[keycloak-github-bot]

Thanks for reporting this issue. However, after review this is not considered a valid issue, or has been recently resolved.

As the issue is not valid it will be automatically closed.

[mnsudhan86]

Hi @pedroigor

Could you please explain why the behavior is deemed as expected?

When user is trying "manage" operation on multiple resources, and for some of which he doesn't have access, decision mode should have replied with a "false", but it is replying with a "true" which incorrectly provides access to user even though he is not administered the access. Isn't this a bug?