Skip to content

Fine Grained Authorization v2 : does not work PUT https://i<keycloak>/admin/realms/<realm>/admin-permissions/groups/<group-id> #48588

@spictera

Description

@spictera

Before reporting an issue

  • I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

admin/fine-grained-permissions

Describe the bug

Hi.
In keycloak older version where fine-grained-authz (version 1) was used, one could call:
const enableGroupPermissions = async (groupId, adminToken) => { try { logger.info(Enabling permissions for group ${groupId}`);

await keycloakAdminService.keycloakAdminRequest(
  'PUT',
  `/groups/${groupId}/management/permissions`,
  {
    enabled: true
  },
  null,
  true
);

logger.info(`Successfully enabled permissions for group ${groupId}`);

} catch (error) {
logger.error(Error enabling permissions for group ${groupId}:, error);
throw error;
}
};
`
But since this PUT URI path is no longer present in v2, and using the replacement which I think is the below:
(note that our function keycloakAdminRequests adds the base uri path /admin/realms/ above)

The new URI I assume is this one:
GROUP OPERATION: PUT https://i<keycloak>/admin/realms/<realm>/admin-permissions/groups/<group-id>

But this fires a HTTP return code 404

Version

26.6

Regression

  • The issue is a regression

Expected behavior

I want to enable Fine Grained Authorization for the groups created, so that a user can managed that team members.

const enableGroupPermissionsV2 = async (groupId) => { try { logger.info(Enabling V2 permissions for group: ${groupId}); await keycloakAdminService.keycloakAdminRequest( 'PUT', admin-permissions/groups/${groupId}, { enabled: true }, null, true ); } catch (error) { if (error.response?.status === 501) { logger.error("FATAL: admin-fine-grained-authz-v2 feature is not enabled in Keycloak startup flags."); } throw error; } };

Actual behavior

HTTP 404

How to Reproduce?

Try calling the API v2 to enable fine grained authorization.

Anything else?

if possible, explain what is the replacement for this, as I want this to be automated via REST API.

Metadata

Metadata

Assignees

No one assigned

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions