upstream/keycloak
1
0
Fork 0
mirror of https://github.com/keycloak/keycloak.git synced 2026-05-28 04:13:22 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Role mapper should check if an update is needed for the role

Browse source 
Closes #43698

Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
This commit is contained in:
Alexander Schwartz 2025-10-28 18:52:51 +01:00 committed by GitHub
parent 3cb9e0bcd8
commit 47288a9643
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
services/src/main/java/org/keycloak/broker/saml/mappers/AbstractAttributeToRoleMapper.java
View file

@ -62,9 +62,15 @@ public abstract class AbstractAttributeToRoleMapper extends AbstractIdentityProv
if (!context.hasMapperGrantedRole(roleName)) {
if (this.applies(mapperModel, context)) {
context.addMapperGrantedRole(roleName);
user.grantRole(role);
if ((!role.isClientRole() && user.getRealmRoleMappingsStream().noneMatch(r -> r.equals(role)))
|| (role.isClientRole() && user.getClientRoleMappingsStream(session.clients().getClientById(realm, role.getContainerId())).noneMatch(r -> r.equals(role)))) {
user.grantRole(role);
}
} else {
user.deleteRoleMapping(role);
if ((!role.isClientRole() && user.getRealmRoleMappingsStream().anyMatch(r -> r.equals(role)))
|| (role.isClientRole() && user.getClientRoleMappingsStream(session.clients().getClientById(realm, role.getContainerId())).anyMatch(r -> r.equals(role)))) {
user.deleteRoleMapping(role);
}
}
}
}