Describe the bug
The existence of an existing client ID is leaked due to the
ordering of permission and policy calls. In a situation where a Client
exists, but the user does not have permission to list all clients, and the
triggerOnEvent call throws an exception, the result will be a bad request
response, rather than a forbidden response.
This affects both the existing admin api logic:
|
throw new ErrorResponseException(cpe.getError(), cpe.getErrorDetail(), Response.Status.BAD_REQUEST); |
And the v2 logic:
|
throw new ServiceException(e.getErrorDetail(), Response.Status.BAD_REQUEST); |
Acknowledgement
Thank you @shawkins for reporting this
Version
26.6
Expected behavior
forbidden response
Actual behavior
bad request response
How to Reproduce?
Anything else?
This issue was originally tracked in the private repository. Migrated by @ahus1.
Describe the bug
The existence of an existing client ID is leaked due to the
ordering of permission and policy calls. In a situation where a Client
exists, but the user does not have permission to list all clients, and the
triggerOnEvent call throws an exception, the result will be a bad request
response, rather than a forbidden response.
This affects both the existing admin api logic:
keycloak/services/src/main/java/org/keycloak/services/resources/admin/ClientResource.java
Line 216 in b941902
And the v2 logic:
keycloak/rest/admin-v2/api/src/main/java/org/keycloak/services/client/NewClientService.java
Line 69 in 30fcb2c
Acknowledgement
Thank you @shawkins for reporting this
Version
26.6
Expected behavior
forbidden response
Actual behavior
bad request response
How to Reproduce?
Anything else?
This issue was originally tracked in the private repository. Migrated by @ahus1.