How to create a policy with enabled fetchRoles using keycloak-admin-client? #35480

Klarys · 2024-12-01T14:07:40Z

Klarys
Dec 1, 2024

Keycloak/keycloak-admin-client version: 25.0.6

Hi! Is setting fetchRoles to true possible?

export default interface PolicyRepresentation {
    config?: Record<string, any>;
    decisionStrategy?: DecisionStrategy;
    description?: string;
    id?: string;
    logic?: Logic;
    name?: string;
    owner?: string;
    policies?: string[];
    resources?: string[];
    scopes?: string[];
    type?: string;
    users?: string[];
    roles?: PolicyRoleRepresentation[];
}

this doesn't have it, and I've tried with config like this:

      policy = await keycloakAdmin.clients.createPolicy(
        {
          id: id!,
          type: 'role',
        },
        {
          name: policyName,
          logic: Logic.POSITIVE,
          decisionStrategy: DecisionStrategy.UNANIMOUS,
          roles: [
            {
              id: roleId,
              required: true,
            },
          ],
          config: {
            fetchRoles: true,
          },
        },
      );

which results in:


2024-12-01 13:36:14,187 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (executor-thread-26) Uncaught server error: java.lang.RuntimeException: Failed to deserialize JSON using policy provider for type [role].
...
Caused by: com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException: Unrecognized field "config" (class org.keycloak.representations.idm.authorization.RolePolicyRepresentation), not marked as ignorable (14 known properties: "fetchRoles", "resources", "scopesData", "name", "decisionStrategy", "policies", "owner", "type", "id", "description", "roles", "logic", "scopes", "resourcesData"])
 at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 207] (through reference chain: org.keycloak.representations.idm.authorization.RolePolicyRepresentation["config"])
...

Thanks in advance!

kowiste · 2025-01-14T16:43:03Z

kowiste
Jan 14, 2025

I have the same problem as you , but I'm in the 26.0.5.
I'm programming a backend in go and the library that I use gocloak have the same fields that the one you put.

So I take a look to the gui how is doing it an figure it out that the problem it was that the library was calling to
/admin/realms/realmID/clients/clientID/authz/resource-server/policy
In the gui it was calling to
/admin/realms/%s/clients/%s/authz/resource-server/policy/role

Plus that change in the url the fetchRole they put it as a field of the policy instead of in the config.

So I end creating a function that call directly the endpoint here you have it just in case you want to use it

type Role struct {
	ID       string `json:"id"`
	Required bool   `json:"required"`
}

type Policy struct {
	Name        string `json:"name"`
	Description string `json:"description"`
	Roles       []Role `json:"roles"`
	FetchRoles  bool   `json:"fetchRoles"`
	Logic       string `json:"logic"`
}

func CreateRolePolicy(ctx context.Context,url, token, tenantID, clientID string, p Policy) (*string, error) {
	baseURL := url+"/admin/realms/%s/clients/%s/authz/resource-server/policy/role"
	endpoint := fmt.Sprintf(baseURL, tenantID, clientID)

	jsonPayload, err := json.Marshal(p)
	if err != nil {
		return nil, fmt.Errorf("failed to marshal policy payload: %w", err)
	}

	req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewBuffer(jsonPayload))
	if err != nil {
		return nil, fmt.Errorf("failed to create request: %w", err)
	}

	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Authorization", "Bearer "+token)

	client := &http.Client{}
	resp, err := client.Do(req)
	if err != nil {
		return nil, fmt.Errorf("failed to send request: %w", err)
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusCreated {
		body, _ := io.ReadAll(resp.Body)
		return nil, fmt.Errorf("failed to create policy. Status: %d, Body: %s", resp.StatusCode, string(body))
	}

	var result struct {
		ID string `json:"id"`
	}
	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
		return nil, fmt.Errorf("failed to decode response: %w", err)
	}

	return &result.ID, nil
}

With this function everything works fine

0 replies

Datzu712 · 2026-01-10T00:08:05Z

Datzu712
Jan 10, 2026

Maybe its a mistake with ts typings & rest api docs > PolicyRepresentation because in the admin UI sends a fetchRoles attribute when creating role policies and if you pass fetchRoles using @ts-expect-error to bypass the type check, it works correctly

await kcAdminClient.clients.createPolicy(
  { id: clientUuid, type: "role", realm: params.realm },
  {
    ...stuff,
    // @ts-expect-error -- ..........
    fetchRoles: true,
  }
); // works fine

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

How to create a policy with enabled fetchRoles using keycloak-admin-client? #35480

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 2 comments

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

How to create a policy with enabled fetchRoles using keycloak-admin-client? #35480

Uh oh!

Uh oh!

Klarys Dec 1, 2024

Replies: 2 comments

Uh oh!

Uh oh!

kowiste Jan 14, 2025

Uh oh!

Datzu712 Jan 10, 2026

Klarys
Dec 1, 2024

kowiste
Jan 14, 2025

Datzu712
Jan 10, 2026