Prevent SCIM user writes from bypassing user-profile edit permissions - #51465
Prevent SCIM user writes from bypassing user-profile edit permissions#51465sguilhen wants to merge 1 commit into
Conversation
Closes keycloak#50991 Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
There was a problem hiding this comment.
Pull request overview
Adds user-profile edit-permission enforcement for SCIM-mapped custom attributes.
Changes:
- Prevents unauthorized custom-attribute mutations.
- Adds PATCH and PUT regression coverage.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
AbstractUserModelSchema.java |
Adds editability evaluation. |
UserExtensionModelSchema.java |
Guards direct model writes. |
UserTest.java |
Tests protected attribute updates. |
| UPAttributePermissions permissions = upAttr.getPermissions(); | ||
|
|
||
| if (permissions == null) { | ||
| return true; | ||
| } | ||
|
|
||
| return !permissions.getEdit().isEmpty(); |
There was a problem hiding this comment.
This is true in theory, but it's the pre-existing behavior and also the intentional design. The SCIM setter lambda has always written directly to the model without any permission check. The existing tests in AbstractScimTest.addOrReplaceUPAttribute() configure attributes with edit=Set.of(ROLE_ADMIN) and they work. SCIM writes to them. If we started checking the context role, we'd break all custom SCIM attribute writes because SCIM is (false, false, false) - not admin - yet it's used as an admin-level API.
Closes #50991