adorsys / keycloak-config-cli

Import YAML/JSON-formatted configuration files into Keycloak - Configuration as Code for Keycloak.
Apache License 2.0
778 stars 140 forks source link

Client authorizationSettings are not imported with config-cli 5.6.1 on Quarkus Keycloak 21.1.1 #876

Closed an966 closed 1 year ago

an966 commented 1 year ago

attachments.zip

Current Behavior

When we import our realm JSON file with the adorsys config-cli, the authorizationSettings defined on the realm-management client are not imported.

Expected Behavior

With adorsys config-cli version 4.3.0 and Wildfly Keycloak 15.0.2 the authorizationSettings defined on the realm-management client are imported as expected.

Steps To Reproduce

Start Quarkus Keycloak 21.1.1 (Features token-exchange & admin_fine_grained_authz enabled)

Import the attached realm JSON file (test-realm.json) with config-cli 5.6.1 (please see attached application.properties for the config-cli configuration)

Login to the Keycloak Admin Console

Navigate to Identity Provider > test-idp > Permission (*/auth/admin/master/console/#/test/identity-providers/keycloak-oidc/keycloak-oidc/permissions)

Check wether the permissions are enabled and
the token-exchange is configured (in my case the permissions are disabled and the token-exchange is not configured) 

Navigate to Clients > token-exchange > Permissions (*/auth/admin/master/console/#/test/clients/client_id/permissions)

Check wether the permissions are enabled and
the token-exchange is configured (in my case the permissions are disabled and the token-exchange is not configured)

Environment

Environment (not working)

Environment (working)

Anything else?

attachments.zip

an966 commented 1 year ago

@jkroepke comment on ticket https://github.com/adorsys/keycloak-config-cli/issues/648 that there are some issues with the Quarkus distribution regarding the import of authorization policies on realm-management client:

https://github.com/adorsys/keycloak-config-cli/issues/648#issuecomment-1054311876

jkroepke commented 1 year ago

@an966 I do not have any access here anymore, since I leaved the company.