Introduce dedicated delegation permission for token exchange delegation by mabartos · Pull Request #51520 · keycloak/keycloak

mabartos · 2026-08-06T15:05:06Z

Closes Introduce dedicated delegation permission for token exchange delegation #51481
New delegate scope on USERS resource type and delegate-members on GROUPS (mirrors impersonate/impersonate-members pattern)
Delegation permissions managed exclusively through FGAP V2 (no admin roles)
canDelegate() only supported in FGAP V2, V1 throws UnsupportedOperationException
DelegationScopeType now calls canDelegate() instead of canImpersonate()
Permission evaluation guarded by TOKEN_EXCHANGE_DELEGATION feature flag

pedroigor

We need migration to add the new scope to existing realms. See #48375.

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-08-07T10:12:14Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#testPostBadAssertionSignature

Keycloak CI - Adapter IT Strict Cookies

org.openqa.selenium.JavascriptException: 
TypeError: can't access property "outerHTML", document.documentElement is null
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1020-azure', java.version: '21.0.11'
Driver info: org.openqa.selenium.firefox.FirefoxDriver
...

Report flaky test

Copilot

Pull request overview

Introduces FGAP V2-specific delegation permissions for token exchange, separating delegation from administrator impersonation.

Changes:

Adds delegate and delegate-members scopes with migration support.
Evaluates delegation through FGAP V2 and the feature flag.
Updates delegation tests and documentation.

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
`tests/base/.../TokenExchangeDelegationTest.java`	Tests delegation permissions.
`tests/base/.../ParameterizedScopesOAuthGrantTest.java`	Updates implicit-flow delegation test.
`services/.../UserPermissionsV2.java`	Implements delegation evaluation.
`services/.../UserPermissions.java`	Rejects delegation under FGAP V1.
`services/.../UserPermissionEvaluator.java`	Adds delegation API methods.
`services/.../IdentityProviderPermissions.java`	Uses shared client attribute constant.
`services/.../ClientPermissions.java`	Uses shared client attribute constant.
`services/.../DelegationScopeType.java`	Switches to delegation permission.
`services/.../ClientScopeAuthorizationRequestParser.java`	Handles unsupported FGAP operations.
`services/.../DefaultEvaluationContext.java`	Uses shared attribute constants.
`server-spi-private/.../EvaluationContext.java`	Defines evaluation attribute constants.
`server-spi-private/.../AdminPermissionsSchema.java`	Defines new FGAP scopes.
`model/storage-private/.../DefaultMigrationManager.java`	Registers the migration.
`model/storage-private/.../MigrateTo26_8_0.java`	Migrates existing FGAP schemas.
`docs/guides/.../token-exchange.adoc`	Documents delegation configuration.
`docs/documentation/.../changes-26_8_0.adoc`	Adds upgrade guidance.
`authz/policy/common/.../ClientPolicyProvider.java`	Uses the shared client attribute.

Copilot

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated no new comments.

Suppressed comments (2)

services/src/main/java/org/keycloak/protocol/oidc/scope/DelegationScopeType.java:72

Client policies cannot authorize this path because this overload supplies no requester, so evaluation from the actor's UserModelIdentity has no kc.client.id; ClientPolicyProvider only grants when that attribute is present. Pass the intended client into delegation evaluation while preserving the actor identity, or remove the documented Client-policy support.

        if (!evaluator.users().canDelegate(currentUser)) {

services/src/main/java/org/keycloak/services/resources/admin/fgap/UserPermissionEvaluator.java:133

The earlier canImpersonate() Javadoc still links to ImpersonationConstants even though this change removes that import, leaving an unresolved Javadoc reference. Update that link to AdminRoles#IMPERSONATION as well.

     * Returns {@code true} if the caller has the {@link AdminRoles#IMPERSONATION} role.

rmartinc

Thanks @mabartos! LGTM, just two comments for your consideration, in case you think that they are useful.

Closes keycloak#51481 Signed-off-by: Martin Bartoš <mabartos@redhat.com>

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

Copilot

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

docs/guides/securing-apps/token-exchange.adoc:371

A Client policy cannot authorize this flow: canDelegate evaluates with a UserModelIdentity and no kc.client.id context attribute, while ClientPolicyProvider only matches that attribute. Following this guidance silently drops the scope, so recommend a User policy for both administrators and service-account users unless the evaluator is changed to provide the actor client ID.

NOTE: To restrict delegation to specific users, select individual users when creating the permission. To restrict which administrators or service accounts can delegate, use a more specific policy (for example, a *User* or *Client* policy).

+    public boolean canDelegate(UserModel user) {
+        return eval.hasPermission(new UserModelRecord(user), null, AdminPermissionsSchema.DELEGATE);
+    }


keycloak-github-bot Bot added the team/core-authn label Aug 6, 2026

mabartos force-pushed the KC-51481 branch 2 times, most recently from 65316b5 to 14ef744 Compare August 6, 2026 15:36

pedroigor reviewed Aug 6, 2026

View reviewed changes

mabartos force-pushed the KC-51481 branch from 14ef744 to e7985df Compare August 7, 2026 09:07

keycloak-github-bot Bot added the flaky-test label Aug 7, 2026

keycloak-github-bot Bot reviewed Aug 7, 2026

View reviewed changes

mabartos force-pushed the KC-51481 branch from e7985df to a0eb65a Compare August 7, 2026 10:15

mabartos requested a balanced review from Copilot August 7, 2026 10:32

mabartos marked this pull request as ready for review August 7, 2026 10:32

mabartos requested a review from a team as a code owner August 7, 2026 10:32

Copilot started reviewing on behalf of mabartos August 7, 2026 10:33 View session

Copilot AI reviewed Aug 7, 2026

View reviewed changes

Comment thread docs/guides/securing-apps/token-exchange.adoc

Comment thread ...s/base/src/test/java/org/keycloak/tests/oauth/tokenexchange/TokenExchangeDelegationTest.java

Copilot AI review requested due to automatic review settings August 7, 2026 10:42

Copilot started reviewing on behalf of mabartos August 7, 2026 10:43 View session

Copilot AI reviewed Aug 7, 2026

View reviewed changes

Comment thread services/src/main/java/org/keycloak/services/resources/admin/fgap/ClientPermissions.java

Comment thread ...es/src/main/java/org/keycloak/services/resources/admin/fgap/IdentityProviderPermissions.java

mabartos requested review from Copilot, pedroigor and rmartinc August 7, 2026 11:55

mabartos force-pushed the KC-51481 branch from 7694a71 to c1edcd0 Compare August 10, 2026 10:30

Copilot started reviewing on behalf of mabartos August 10, 2026 10:30 View session

Copilot AI reviewed Aug 10, 2026

View reviewed changes

rmartinc reviewed Aug 10, 2026

View reviewed changes

mabartos added 2 commits August 10, 2026 13:53

Introduce dedicated delegation permission for token exchange delegation

54e8047

Closes keycloak#51481 Signed-off-by: Martin Bartoš <mabartos@redhat.com>

Remove ClientModel from the interface signature, remove feature barrier

566a53d

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

Copilot AI review requested due to automatic review settings August 10, 2026 11:56

mabartos force-pushed the KC-51481 branch from c1edcd0 to 566a53d Compare August 10, 2026 11:56

Copilot started reviewing on behalf of mabartos August 10, 2026 11:57 View session

mabartos requested a review from rmartinc August 10, 2026 11:58

Copilot AI reviewed Aug 10, 2026

View reviewed changes

Comment thread services/src/main/java/org/keycloak/services/resources/admin/fgap/UserPermissionsV2.java

Comment on lines +136 to +138

public boolean canDelegate(UserModel user) {

return eval.hasPermission(new UserModelRecord(user), null, AdminPermissionsSchema.DELEGATE);

}

Navigation Menu

Uh oh!

Introduce dedicated delegation permission for token exchange delegation - #51520

Introduce dedicated delegation permission for token exchange delegation#51520
mabartos wants to merge 2 commits into
keycloak:mainfrom
mabartos:KC-51481

mabartos commented Aug 6, 2026 •

edited

Loading

Uh oh!

pedroigor left a comment

Uh oh!

keycloak-github-bot Bot left a comment

Uh oh!

keycloak-github-bot Bot commented Aug 7, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

rmartinc left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

mabartos commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pedroigor left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot commented Aug 7, 2026

Unreported flaky test detected

org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#testPostBadAssertionSignature

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

rmartinc left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

mabartos commented Aug 6, 2026 •

edited

Loading