Group Attribute Search Erroneously returns when searching for nested group

[alice-wondered]

Before reporting an issue

• I have searched existing issues
• I have reproduced the issue with the latest release

Area

storage

Describe the bug

When given a group structure such as

• group1 (attr: <test, test> )
• group2
  -- group2_a (attr: <group2_test, group2_test>)
  -- group2_b

Querying for the attribute (test, test) of group1 will correctly return group1

Querying for the attribute (group2_test, group2_test) will incorrectly return group2 as well as both sub groups.

Version

confirmed on main branch

Expected behavior

Querying for a sub group should only return that sub group

However, a test was added that checks that the problematic behavior actually does occur. I believe this was added erroneously (by me) and not caught.

`GroupSearchTest:

Actual behavior

Querying for a sub group by attribute should only return that sub group as it's the only one relevant to the search

How to Reproduce?

GET /auth/admin/realms/redhat-external/groups?q=:&first=0&max=20

Anything else?

No response

[hmlnarik]

This behaviour is expected since this is the way the REST endpoints were crafted for use in admin console.

That said, the behaviour you are asking for, i.e. returning the list of the groups directly, is reasonable.

I suggest extending the org.keycloak.services.resources.admin.GroupsResource.getGroups method with ignoreHierarchy boolean flag. If false (default), the behaviour remains as is today. If true, it would return only those groups matching the query without resolving their hierarchy, leading to extending / updating the searchGroups* methods in the ModelToRepresentation class.

[alice-wondered]

I have updated my PR to extend the behavior as suggested and added another test case that shows that this functionality is working as expected