diff --git a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/role/RolePolicyProviderFactory.java b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/role/RolePolicyProviderFactory.java index bd00d0b9fda..c8fc82d7f32 100644 --- a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/role/RolePolicyProviderFactory.java +++ b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/role/RolePolicyProviderFactory.java @@ -85,8 +85,9 @@ public class RolePolicyProviderFactory implements PolicyProviderFactory( - Arrays.asList(JsonSerialization.readValue(roles, RolePolicyRepresentation.RoleDefinition[].class)))); + List roleDefinitions = Arrays.asList(JsonSerialization.readValue(roles, RolePolicyRepresentation.RoleDefinition[].class)); + roleDefinitions.removeIf(definition -> getRole(definition, authorization.getRealm()) == null); + representation.setRoles(new HashSet<>(roleDefinitions)); } String fetchRoles = policy.getConfig().get("fetchRoles"); @@ -171,35 +172,9 @@ public class RolePolicyProviderFactory implements PolicyProviderFactory { - if (event instanceof RoleRemovedEvent) { - KeycloakSession keycloakSession = ((RoleRemovedEvent) event).getKeycloakSession(); - AuthorizationProvider provider = keycloakSession.getProvider(AuthorizationProvider.class); - StoreFactory storeFactory = provider.getStoreFactory(); - PolicyStore policyStore = storeFactory.getPolicyStore(); - RoleModel removedRole = ((RoleRemovedEvent) event).getRole(); - RoleContainerModel container = removedRole.getContainer(); - ResourceServerStore resourceServerStore = storeFactory.getResourceServerStore(); - if (container instanceof RealmModel) { - RealmModel realm = (RealmModel) container; - realm.getClientsStream() - .forEach(clientModel -> updateResourceServer(clientModel, removedRole, resourceServerStore, policyStore)); - } else { - ClientModel clientModel = (ClientModel) container; - updateResourceServer(clientModel, removedRole, resourceServerStore, policyStore); - } - } - }); - } - - private void updateResourceServer(ClientModel clientModel, RoleModel removedRole, ResourceServerStore resourceServerStore, PolicyStore policyStore) { - ResourceServer resourceServer = resourceServerStore.findByClient(clientModel); - - if (resourceServer != null) { - policyStore.findByType(resourceServer, getId()).forEach(policy -> { - List roles = new ArrayList<>(); - - for (Map role : getRoles(policy)) { - if (!role.get("id").equals(removedRole.getId())) { - Map updated = new HashMap(); - updated.put("id", role.get("id")); - Object required = role.get("required"); - if (required != null) { - updated.put("required", required); - } - roles.add(updated); - } - } - - try { - if (roles.isEmpty()) { - policyStore.delete(policy.getId()); - } else { - policy.putConfig("roles", JsonSerialization.writeValueAsString(roles)); - } - } catch (IOException e) { - throw new RuntimeException("Error while synchronizing roles with policy [" + policy.getName() + "].", e); - } - }); - } } @Override @@ -299,4 +223,35 @@ public class RolePolicyProviderFactory implements PolicyProviderFactory