Unable to view childgroup users with view-members permission on the parent group

[antikalk]

Before reporting an issue

• I have searched existing issues
• I have reproduced the issue with the latest release

Area

admin/fine-grained-permissions

Describe the bug

When having the view-members permission on a parent group I am unable to view the users of the corresponding child groups. As there is code that should allow this, I suspect there is a bug.

My guess would be it has something to do with this section here:

keycloak/rest/admin-ui-ext/src/main/java/org/keycloak/admin/ui/rest/BruteForceUsersResource.java

Lines 148 to 154 in 017ddc6

	if (!auth.users().canView()) {
	Set<String> groupModels = auth.groups().getGroupsWithViewPermission();
	if (!groupModels.isEmpty()) {
	session.setAttribute(UserModel.GROUPS, groupModels);
	}
	}

While debugging I found out that here only the ID for the parent group is returned and then applied to the session. getGroupsWithViewPermission() does not return the IDs of child groups. This again is then used as a filter in the JpaUserProvider. In the response of the searchForUserStream(...) call I can not see the users of the child groups.

Same applies for service account users accessing the /users endpoint. Only users of the parent group are returned.

Version

20.0.3

Expected behavior

The user should be able to see all users that are members of the parent and child groups.

Actual behavior

The user only sees the users that are members of groups he has the view-members permission for (in this case the parent itself).

How to Reproduce?

1. Create a user with role query-users and username parent_group_manager
2. Create group with name parent
3. Create subgroup of group parent with the name child
4. Now enable permissions for group parent
5. Add a user policy for the created user parent_group_manager
6. Add this policy to the view-members permission of the parent group
7. Add some users to the child group
8. Login in the admin-ui as the user parent_group_manager
9. Head to the users page and see it is empty...

Anything else?

No response

[antikalk]

I have created a branch in which I try to address the issue: https://github.com/antikalk/keycloak/tree/issue-16966

Unfortunately this requires me to remove the check if a resource exists for a given group id in the JpaUserStorage. It would be cool if someone could have a look at it and provide feedback :)