keycloak/keycloak

Evaluation in "Permission" tab for "Clients" resource type put first char from client id

Open

#42904 opened on Sep 24, 2025

View on GitHub
 (6 comments) (1 reaction) (0 assignees)Java (34,398 stars) (8,346 forks)batch import
area/admin/fine-grained-permissionsarea/corehelp wantedkind/bugpriority/normalstatus/auto-bumpteam/core-iamteam/core-shared

Description

Before reporting an issue

  • I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

core

Describe the bug

While we try to evaluate permission for "Client" resource type result is "The selected user does not have access to the selected resource(s)". When we go to Network we see the evaluate method put first symbol from client id in Payload -> resources

Version

26.3.3

Regression

  • The issue is a regression

Expected behavior

Evaluate method correct put field from client id

Actual behavior

Evaluate method get only first symbol from client id

How to Reproduce?

  1. Go to "Permissions" tab
  2. Select tab "Evaluation"
  3. set user
  4. set "Resource type" to "Clients"
  5. Select any client
  6. select any authorization scope
  7. press button "Evaluate"

Anything else?

No response

Contributor guide

Tech stack
javarest api
Domain
backendauthorization
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
JavaKeycloak authorization servicesREST API
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
60
Research direction
The bug is that the evaluation endpoint for client permissions sends only the first character of the client ID in the resources field. Start by examining the authorization evaluation REST endpoint (likely in `AuthorizationEvaluationService` or similar). Look for how the client ID is extracted and serialized when building the payload. The issue may be a substring bug or a mapping error. Check the relevant controller class and the DTO for the evaluate request. Also look at the frontend code in the admin console if the issue originates there. Review recent commits or comments for any clues. A good starting point is to search for 'evaluate' in the codebase and trace the client ID handling.