AuthzClient getPermissions() deserializes to List<LinkedHashSet> and not List<Permission> (previously #16520 )

[clezag]

Before reporting an issue

• I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

authorization-services

Describe the bug

This bug as previously reported in #16520, but erroneously closed as fixed.
I've opened this issue because I did not get any feedback on my comments or PR in the closed issue.

Using the Java AuthzClient,
List<Permission> permissions = authorizationResource.getPermissions(authorizationRequest);
returns a List<LinkedHashMap> instead of a List<Permission>

The actual runtime type of the returned list differs from the documented compile time type.
This causes a runtime Exception as soon as you use the individual objects in the list, because they don't match the compiled type.

This behavior is documented by a preexisting test. Note inexplicably casting the returned object to a Map before using it. Permission does not implement the Map interface, the two types are completely incompatible. This code should not work:

keycloak/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/authz/RegexPolicyTest.java

Line 293 in 343479d

Assert.assertTrue(((Map)permissions.get(0)).get("rsname").equals("service"));

I have an open PR on the old issue (#27813) that should fix this

Version

24.0

Regression

• The issue is a regression

Expected behavior

The returned List<Permission> is a java.util.List containing Permission objects

Actual behavior

The returned list is a List contains LinkedHashMap objects

How to Reproduce?

AuthorizationResource authorizationResource = authClient.authorization(token);

AuthorizationRequest authorizationRequest = new AuthorizationRequest();
authorizationRequest.setAudience(audience);
authorizationRequest.setScope("read");
AuthorizationRequest.Metadata metadata = new AuthorizationRequest.Metadata();
metadata.setResponseMode("permissions");
authorizationRequest.setMetadata(metadata);

List<Permission> permissions = authorizationResource.getPermissions(authorizationRequest);
permissions.get(0).getResourceName();

Will lead to exception because the type of permissions.get(0) is not Permission and thus the method call getResourceName is not possible

Alternatively, applying this change to an existing test will also make it fail

Anything else?

No response

[keycloak-github-bot]

Due to the amount of issues reported by the community we are not able to prioritise resolving this issue at the moment.

If you are affected by this issue, upvote it by adding a 👍 to the description. We would also welcome a contribution to fix the issue.

[clezag]

Closed by #27813