{"action":"opened","issue":{"url":"https://api.github.com/repos/3scale/apicast/issues/889","repository_url":"https://api.github.com/repos/3scale/apicast","labels_url":"https://api.github.com/repos/3scale/apicast/issues/889/labels{/name}","comments_url":"https://api.github.com/repos/3scale/apicast/issues/889/comments","events_url":"https://api.github.com/repos/3scale/apicast/issues/889/events","html_url":"https://github.com/3scale/apicast/issues/889","id":358565189,"node_id":"MDU6SXNzdWUzNTg1NjUxODk=","number":889,"title":"Keycloak role check policy - only whitelisted resources (endpoints) are allowed","user":{"login":"mayorova","id":1270328,"node_id":"MDQ6VXNlcjEyNzAzMjg=","avatar_url":"https://avatars0.githubusercontent.com/u/1270328?v=4","gravatar_id":"","url":"https://api.github.com/users/mayorova","html_url":"https://github.com/mayorova","followers_url":"https://api.github.com/users/mayorova/followers","following_url":"https://api.github.com/users/mayorova/following{/other_user}","gists_url":"https://api.github.com/users/mayorova/gists{/gist_id}","starred_url":"https://api.github.com/users/mayorova/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mayorova/subscriptions","organizations_url":"https://api.github.com/users/mayorova/orgs","repos_url":"https://api.github.com/users/mayorova/repos","events_url":"https://api.github.com/users/mayorova/events{/privacy}","received_events_url":"https://api.github.com/users/mayorova/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-09-10T10:37:41Z","updated_at":"2018-09-10T10:37:41Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"I noticed the following behavior in the current implementation of the Keycloak role check policy:\r\n\r\nIt looks like when \"whitelist\" type is used, ALL endpoints you have configured would need to have rules defined, otherwise authorization fails.\r\n\r\nFor example, if I have a number of endpoints endpoints, say, `/one`, `/two`, `/three`, and I don't care about roles for these ones - I just authorize normally (using mapping rules and rate limits).\r\nBut then I also have `/admin` endpoint for which I want to check if the `admin` role appears in the JWT (as a realm role, for example).\r\n\r\nIf I configure \"whitelist\" for resource `/admin` with the realm role `admin`, all other endpoints will fail.\r\nIt looks like this is the desired behavior ([spec](https://github.com/3scale/apicast/blob/3.3-stable/spec/policy/keycloak_role_check/keycloak_role_check_spec.lua#L261-L264)). But to me it seems quite limited, as it obliges me to duplicate all mapping rules in the role check policy configuration, even if I don't care about the roles JWT token has for these endpoints.\r\n\r\n@y-tabata @tmogi001 Is this how you expect the policy to work? "}}
{"actor":{"display_login":"mayorova"}}