Open escoand opened 4 years ago
I would like to white list access to index.html, menu.html and *.css in subfolders
But you are whitelisting a bunch of resources. Why?
--resources "uri=/|white-listed=true" \
--resources "uri=/css/*|white-listed=true" \
--resources "uri=/favicon.ico|white-listed=true" \
--resources "uri=/health|white-listed=true" \
--resources "uri=/img/*|white-listed=true" \
--resources "uri=/index.html|white-listed=true" \
--resources "uri=/js/*|white-listed=true" \
--resources "uri=/ws|white-listed=true" \
--resources "uri=/*/|white-listed=true" \
--resources "uri=/*/index.html|white-listed=true" \
--resources "uri=/*/menu.html|white-listed=true" \
--resources "uri=/*/*.css|white-listed=true" \
Why not only?:
--resources "uri=/index.html|white-listed=true" \
--resources "uri=/menu.html|white-listed=true" \
--resources "uri=/*/*.css|white-listed=true" \
You will get deny response only, when role is defined per resource defined AND that roles is not in the user access token. So I would try to define "deny" wild resource and that explicitly whitelist selected resources.
--resources "uri=/*|roles=role-which-doesnt-exist" \
--resources "uri=/index.html|white-listed=true" \
--resources "uri=/menu.html|white-listed=true" \
--resources "uri=/*/*.css|white-listed=true" \
It may need more tweaking.
I would like to white list access to index.html, menu.html and *.css in subfolders
But you are whitelisting a bunch of resources. Why?
I meant index.html
in subfolders, menu.html
in subfolders and *.css
in subfolders. This files should be accessible without login, but not the other files in subfolders.
You will get deny response only, when role is defined per resource defined AND that roles is not in the user access token. So I would try to define "deny" wild resource and that explicitly whitelist selected resources.
Obviously my question was a bit misleading. With "deny" I meant "redirects to login".
I think the stripped down question is: in which order are these resources evaluated and does is stop after the first match?
--resources "uri=/*/index.html|white-listed=true" \
--resources "uri=/*/menu.html|white-listed=true" \
--resources "uri=/*/*|roles=role1,rol2|require-any-role=true"
Maybe the problem is related with #661 and this is the only problem.
@escoand indeed, in my experience as explained in #661, --resources "uri=/*/menu.html|white-listed=true"
is equivalent to --resources "uri=/*|white-listed=true"
, which does explain this issue too.
Title
Unable to deny access to only some files in subfolders
Summary
It's no completely clear how to set multiple resources parameter correctly when using wildcards. My current configuration is this:
Environment
Version of everything that it's running in your environment:
uname -a
):Linux 82bac00f-fd21-483a-4cc6-c0e0 4.15.0-106-generic #107~16.04.1-Ubuntu SMP Thu Jun 4 15:40:05 UTC 2020 x86_64 Linux
keycloak-gatekeeper version 10.0.1 (git+sha: 691bc4c, built: 08-05-2020)
Expected Results
I would like to white list access to
index.html
,menu.html
and*.css
in subfolders, but deny on any other file. But I found no way to do so. Don't know if this is a bug or just not possible currently.Actual Results
Every file in a subfolder (except
/css/
,/img/
and/js/
) is denied.Steps to reproduce
Additional Information