Group hierarchy search discloses hidden parent groups under FGAP v2 by vramik · Pull Request #50967 · keycloak/keycloak

vramik · 2026-07-16T19:04:31Z

Design decision: Align with industry standard — parent existence (name, ID, path) is inherent to the child's identity and not hidden. Only parent content (attributes, role mappings, access) is protected. Non-viewable parents are included in the hierarchy as stripped/brief representations.

Approach: when populating group hierarchy under FGAP v2, non-viewable parent groups are represented with only structural fields (id, name, description, path, parentId) — no attributes, role mappings, or access map. The hierarchy walk continues through stripped parents so the full tree structure is preserved.

Copilot

Pull request overview

Prevents FGAP v2 group searches from exposing protected parent-group content while preserving hierarchy structure.

Changes:

Returns brief representations for non-viewable ancestors.
Adds an integration test for redacted parent data.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
`services/src/main/java/org/keycloak/utils/GroupUtils.java`	Applies permission-aware hierarchy redaction.
`tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/GroupResourceTypeFilteringTest.java`	Tests stripped hidden-parent responses.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/GroupResourceTypeFilteringTest.java:102

This parent is top-level, so the regression test only exercises one hierarchy iteration and does not verify the stated requirement that traversal continues through multiple non-viewable ancestors. Add a grandparent (or deeper chain) and assert that every hidden ancestor is retained as a stripped representation around the visible descendant.

        GroupRepresentation parentGroup = realm.admin().groups().groups("group-0", -1, -1).get(0);

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-07-21T10:16:49Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.BrowserFlowTest#testUserWithOneAdditionalFactorOtpSuccess

Keycloak CI - Base IT (5)

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

martin-kanis

@vramik Thanks for the PR! Few points:

There might be UI regression when an admin has VIEW on a child group but not on its parent and searches for the child group - only parent is rendered as a leaf node and the child group admin searched for is invisible
Consider adding an entry to "Notable changes" in upgrading guide as we have there some similar entries for listing sessions

Copilot

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

js/apps/admin-ui/src/groups/GroupsSection.tsx:116

Group names may contain / (see GroupSearchTest.testGroupsWithSlashes), and group paths are ambiguous when slash escaping is disabled by default. Splitting the leaf path positionally can therefore label an ancestor incorrectly—for example, /parent/slash/child assigns parent instead of parent/slash; obtain ancestor names from group representations keyed by the route IDs rather than parsing path.

          const segments = lastGroup.path.split("/").filter(Boolean);

martin-kanis

Thanks for the update.

I would like to invite @ssilvert to have a look at UI as there is more changed lines now.

Besides the Copilot's comment you are looking at, there might be a problem with GroupPickerDialog when clicking a stripped parent row, user will get 403 error page.

The backend changes, tests and documentation looks good to me.

Copilot

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

js/apps/admin-ui/src/groups/components/GroupTree.tsx:351

This also blocks navigation for organization groups because their representations do not contain access; organization authorization is enforced separately by OrganizationGroupsResource. Include isOrgGroups in the allow condition, as GroupTable.tsx:212 already does for the same reason.

    const path = findGroup(data, item.id!, []);
    if (!(canViewDetails || path.at(-1)?.access?.view)) {
      return;

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-07-23T14:14:26Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.MultipleTabsLoginTest#testLoginPageRefresh

Keycloak CI - Forms IT (chrome)

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

edewit · 2026-07-24T07:18:00Z

+              error instanceof NetworkError &&
+              error.response.status === 403
+            ) {
+              group = undefined;


if there is an error wouldn't group still be undefined?

Yes, group would still be undefined. The point of the catch is not to set the value — it's to prevent the 403 NetworkError from propagating to the error boundary, which would crash the entire page. Without the catch, useFetch passes the error to showBoundary() and the page is replaced with "You don't have access to the admin console." The catch swallows the 403 so execution continues to the if (!group) check, which shows a friendly "not found" message inside the dialog.

I am more than open to suggestions for improvemnt here.

But I think, if we go with this approach then if (!group) throw new Error(t("notFound")) will throw then useFetch catches it and showBoundary(error) replaces the whole page.
Cannot we filter stripped parents out of the flattened list?

In GroupPickerDialog.tsx // line 61 const groupResource = useGroupResource(); const isOrgGroups = groupResource.isOrgGroups(); // lines 258-260 .map((g) => deepGroup([g])) .flat() .filter((g) => isOrgGroups || g.access) .map((g) => (

Copilot

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

+          <span
+            className={
+              !canViewDetails && !isOrgGroups && !group.access?.view
+                ? "keycloak-groups-tree__non-viewable"
+                : undefined


Closes keycloak#50966 Signed-off-by: vramik <vramik@redhat.com>

Copilot

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated no new comments.

Copilot AI review requested due to automatic review settings July 16, 2026 19:04

vramik requested a review from a team as a code owner July 16, 2026 19:04

keycloak-github-bot Bot added the team/core-iam label Jul 16, 2026

vramik requested a review from martin-kanis July 16, 2026 19:04

Copilot started reviewing on behalf of vramik July 16, 2026 19:04 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

Comment thread services/src/main/java/org/keycloak/utils/GroupUtils.java

Copilot AI review requested due to automatic review settings July 16, 2026 19:22

vramik force-pushed the cve-891 branch from 6aedcd8 to e27677d Compare July 16, 2026 19:22

Copilot started reviewing on behalf of vramik July 16, 2026 19:23 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

Comment thread services/src/main/java/org/keycloak/utils/GroupUtils.java

Comment thread ...s/base/src/test/java/org/keycloak/tests/admin/authz/fgap/GroupResourceTypeFilteringTest.java

Copilot AI review requested due to automatic review settings July 16, 2026 19:36

vramik force-pushed the cve-891 branch from e27677d to 9ab315d Compare July 16, 2026 19:36

Copilot started reviewing on behalf of vramik July 16, 2026 19:37 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

Comment thread ...s/base/src/test/java/org/keycloak/tests/admin/authz/fgap/GroupResourceTypeFilteringTest.java

Copilot AI review requested due to automatic review settings July 16, 2026 20:25

vramik force-pushed the cve-891 branch from 9ab315d to f91c209 Compare July 16, 2026 20:25

Copilot started reviewing on behalf of vramik July 16, 2026 20:26 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 21, 2026 09:01

vramik force-pushed the cve-891 branch from f91c209 to be667b0 Compare July 21, 2026 09:01

Copilot started reviewing on behalf of vramik July 21, 2026 09:07 View session

Copilot AI reviewed Jul 21, 2026

View reviewed changes

keycloak-github-bot Bot added the flaky-test label Jul 21, 2026

This was referenced Jul 21, 2026

Flaky test: org.keycloak.testsuite.oauth.ClientAuthPostMethodTest#testPostAuthenticationNotAllowedWhenBasicRequested #51052

Closed

Flaky test: org.keycloak.testsuite.oauth.ClientAuthPostMethodTest#testBasicAuthenticationNotAllowedWhenPostRequested #51053

Closed

keycloak-github-bot Bot reviewed Jul 21, 2026

View reviewed changes

martin-kanis reviewed Jul 21, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 22, 2026 21:47

vramik force-pushed the cve-891 branch from be667b0 to 29cd7d8 Compare July 22, 2026 21:47

Copilot AI reviewed Jul 22, 2026

View reviewed changes

Comment thread js/apps/admin-ui/src/groups/GroupsSection.tsx

Copilot AI review requested due to automatic review settings July 22, 2026 21:54

vramik force-pushed the cve-891 branch from 29cd7d8 to 6bb7c93 Compare July 22, 2026 21:54

Copilot started reviewing on behalf of vramik July 22, 2026 21:54 View session

Copilot AI reviewed Jul 22, 2026

View reviewed changes

Comment thread js/apps/admin-ui/src/groups/GroupsSection.tsx Outdated

martin-kanis requested a review from ssilvert July 23, 2026 09:24

martin-kanis suggested changes Jul 23, 2026

View reviewed changes

Comment thread js/apps/admin-ui/src/components/bread-crumb/GroupBreadCrumbs.tsx Outdated

Comment thread js/apps/admin-ui/src/groups/GroupsSection.tsx

Copilot AI review requested due to automatic review settings July 23, 2026 11:00

vramik force-pushed the cve-891 branch from 6bb7c93 to ca2d042 Compare July 23, 2026 11:00

Copilot started reviewing on behalf of vramik July 23, 2026 11:01 View session

Copilot AI reviewed Jul 23, 2026

View reviewed changes

Comment thread js/apps/admin-ui/src/groups/components/GroupTree.tsx

Comment thread js/apps/admin-ui/src/components/bread-crumb/GroupBreadCrumbs.tsx Outdated

keycloak-github-bot Bot mentioned this pull request Jul 23, 2026

Flaky test: org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRefreshInTab1 #51075

Closed

vramik force-pushed the cve-891 branch 2 times, most recently from ccfbcdf to 3b0a90a Compare July 23, 2026 13:09

keycloak-github-bot Bot reviewed Jul 23, 2026

View reviewed changes

edewit previously approved these changes Jul 24, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 27, 2026 11:47

vramik dismissed edewit’s stale review via e24081d July 27, 2026 11:47

vramik force-pushed the cve-891 branch from 3b0a90a to e24081d Compare July 27, 2026 11:47

Copilot started reviewing on behalf of vramik July 27, 2026 11:48 View session

Copilot AI reviewed Jul 27, 2026

View reviewed changes

Comment thread js/apps/admin-ui/src/groups/components/GroupTree.tsx

Comment on lines +209 to +213

<span

className={

!canViewDetails && !isOrgGroups && !group.access?.view

? "keycloak-groups-tree__non-viewable"

: undefined

Group hierarchy search discloses hidden parent groups under FGAP v2

3c999a8

Closes keycloak#50966 Signed-off-by: vramik <vramik@redhat.com>

Copilot AI review requested due to automatic review settings July 27, 2026 12:14

vramik force-pushed the cve-891 branch from e24081d to 3c999a8 Compare July 27, 2026 12:14

Copilot started reviewing on behalf of vramik July 27, 2026 12:14 View session

Copilot AI reviewed Jul 27, 2026

View reviewed changes

Uh oh!

Conversation

vramik commented Jul 16, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot commented Jul 21, 2026

Unreported flaky test detected

org.keycloak.testsuite.forms.BrowserFlowTest#testUserWithOneAdditionalFactorOtpSuccess

Uh oh!

martin-kanis left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

martin-kanis left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot commented Jul 23, 2026

Unreported flaky test detected

org.keycloak.testsuite.forms.MultipleTabsLoginTest#testLoginPageRefresh

Uh oh!

edewit Jul 24, 2026

Choose a reason for hiding this comment

Uh oh!

vramik Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

martin-kanis Jul 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

vramik Jul 24, 2026 •

edited

Loading