Skip to content

Prevent SCIM user writes from bypassing user-profile edit permissions - #51465

Open
sguilhen wants to merge 1 commit into
keycloak:mainfrom
sguilhen:50991-scim-user-profile-edit-bypass
Open

Prevent SCIM user writes from bypassing user-profile edit permissions#51465
sguilhen wants to merge 1 commit into
keycloak:mainfrom
sguilhen:50991-scim-user-profile-edit-bypass

Conversation

@sguilhen

@sguilhen sguilhen commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Closes #50991

Closes keycloak#50991

Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
Copilot AI balanced review requested due to automatic review settings August 5, 2026 17:01
@sguilhen
sguilhen requested a review from a team as a code owner August 5, 2026 17:01

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds user-profile edit-permission enforcement for SCIM-mapped custom attributes.

Changes:

  • Prevents unauthorized custom-attribute mutations.
  • Adds PATCH and PUT regression coverage.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File Description
AbstractUserModelSchema.java Adds editability evaluation.
UserExtensionModelSchema.java Guards direct model writes.
UserTest.java Tests protected attribute updates.

Comment on lines +134 to +140
UPAttributePermissions permissions = upAttr.getPermissions();

if (permissions == null) {
return true;
}

return !permissions.getEdit().isEmpty();

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is true in theory, but it's the pre-existing behavior and also the intentional design. The SCIM setter lambda has always written directly to the model without any permission check. The existing tests in AbstractScimTest.addOrReplaceUPAttribute() configure attributes with edit=Set.of(ROLE_ADMIN) and they work. SCIM writes to them. If we started checking the context role, we'd break all custom SCIM attribute writes because SCIM is (false, false, false) - not admin - yet it's used as an admin-level API.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

SCIM user writes bypass user-profile edit permissions for custom attributes

2 participants