From 5995815bcc31ed284ce5a3977a8dcf6a157e2f3a Mon Sep 17 00:00:00 2001 From: Alexander Schwartz Date: Fri, 24 Oct 2025 16:45:35 +0200 Subject: [PATCH] Fixing tests Signed-off-by: Alexander Schwartz --- .../broker/saml/mappers/AbstractAttributeToRoleMapper.java | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/services/src/main/java/org/keycloak/broker/saml/mappers/AbstractAttributeToRoleMapper.java b/services/src/main/java/org/keycloak/broker/saml/mappers/AbstractAttributeToRoleMapper.java index a924930b2ef..2e7bb6bfbae 100644 --- a/services/src/main/java/org/keycloak/broker/saml/mappers/AbstractAttributeToRoleMapper.java +++ b/services/src/main/java/org/keycloak/broker/saml/mappers/AbstractAttributeToRoleMapper.java @@ -62,11 +62,13 @@ public abstract class AbstractAttributeToRoleMapper extends AbstractIdentityProv if (!context.hasMapperGrantedRole(roleName)) { if (this.applies(mapperModel, context)) { context.addMapperGrantedRole(roleName); - if (user.getRealmRoleMappingsStream().noneMatch(r -> r.equals(role))) { + if ((!role.isClientRole() && user.getRealmRoleMappingsStream().noneMatch(r -> r.equals(role))) + || (role.isClientRole() && user.getClientRoleMappingsStream(session.clients().getClientById(realm, role.getContainerId())).noneMatch(r -> r.equals(role)))) { user.grantRole(role); } } else { - if (user.getRealmRoleMappingsStream().anyMatch(r -> r.equals(role))) { + if ((!role.isClientRole() && user.getRealmRoleMappingsStream().anyMatch(r -> r.equals(role))) + || (role.isClientRole() && user.getClientRoleMappingsStream(session.clients().getClientById(realm, role.getContainerId())).anyMatch(r -> r.equals(role)))) { user.deleteRoleMapping(role); } }