Enforce membership permission when creating users - #51458

tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/UserResourceTypeEvaluationTest.java:526

• search(\"myadmin\").get(0) assumes the first hit is the intended user and that ordering is stable. To avoid nondeterministic failures, select the exact match (e.g., filter by getUsername().equals(\"myadmin\")) and assert it exists uniquely before using getId().

        UserRepresentation myadmin = realm.admin().users().search("myadmin").get(0);
        UserPolicyRepresentation allowMyAdminPermission = createUserPolicy(realm, adminPermissionsClient, "Only My Admin User Policy", myadmin.getId());

tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/UserResourceTypeEvaluationTest.java:534

• The test creates two groups but doesn’t register cleanup for them, which can leak state across test runs and make failures harder to debug. Add cleanup entries to delete permittedGroup / unpermittedGroup at the end of the test (similar to the user deletions).

        GroupRepresentation permittedGroup = createGroup("permitted-group");
        GroupRepresentation unpermittedGroup = createGroup("unpermitted-group");

server-spi-private/src/main/java/org/keycloak/models/utils/RepresentationToModel.java:809

• The new overload makes group assignment dependent on the provided membershipHandler, but this isn’t obvious from the signature and is easy to misuse (e.g., passing a permission-check-only consumer and unintentionally skipping joinGroup). Consider adding Javadoc that explicitly states the consumer must perform the membership operation, or adjust the API to separate 'authorize' from 'join' to prevent accidental no-op group assignment.

    public static void createGroups(KeycloakSession session, UserRepresentation userRep, RealmModel newRealm, UserModel user) {
        createGroups(session, userRep, newRealm, user, user::joinGroup);
    }

    public static void createGroups(KeycloakSession session, UserRepresentation userRep, RealmModel newRealm, UserModel user, Consumer<GroupModel> membershipHandler) {
        Objects.requireNonNull(membershipHandler, "membershipHandler must not be null");

tests/base/src/test/java/org/keycloak/tests/admin/authz/fgap/UserResourceTypeEvaluationTest.java:562

• This mixed-group case joins the permitted group before authorization fails on the second group, but the test only checks the HTTP status. Please also assert that the user was not persisted so this security regression test covers rollback/atomicity rather than allowing a 403 with partial creation.

        // creating a user assigned to both groups should also be forbidden
        try (Response response = realmAdminClient.realm(realm.getName()).users()
                .create(UserBuilder.create().username("user-both-groups")
                        .groups("/" + permittedGroup.getName(), "/" + unpermittedGroup.getName()).build())) {
            assertEquals(Response.Status.FORBIDDEN.getStatusCode(), response.getStatus());