cameleer/cameleer-server
1
0
Fork 0
Code Issues 41 Pull Requests Actions Packages Projects Releases Wiki Activity

fix: use managed assignments for OIDC fallback role paths
All checks were successful
CI / cleanup-branch (push) Has been skipped
Details
CI / build (push) Successful in 1m31s
Details
CI / docker (push) Successful in 1m7s
Details
CI / deploy-feature (push) Has been skipped
Details
CI / deploy (push) Successful in 38s
Details

Browse Source 
The roles-claim and default-roles fallback paths in applyClaimMappings
were using assignRoleToUser (origin='direct'), causing OIDC-derived
roles to accumulate across logins and never be cleared. Changed both
to assignManagedRole (origin='managed') so all OIDC-assigned roles
are cleared and re-evaluated on every login, same as claim mapping
rules. Only roles assigned directly via the admin UI are preserved.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
hsiegeln
2026-04-14 17:19:20 +02:00
parent 58e802e2d4
commit dcd0b4ebcd
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
cameleer3-server-app/src/main/java/com/cameleer3/server/app/security/OidcAuthController.java
View File

@@ -222,7 +222,7 @@ public class OidcAuthController {
for (String roleName : oidcExtractedRoles) { for (String roleName : oidcExtractedRoles) {
UUID roleId = SystemRole.BY_NAME.get(SystemRole.normalizeScope(roleName)); UUID roleId = SystemRole.BY_NAME.get(SystemRole.normalizeScope(roleName));
if (roleId != null) { if (roleId != null) {
rbacService.assignRoleToUser(userId, roleId); rbacService.assignManagedRole(userId, roleId, null);
log.info("OIDC role {} assigned to {} (from token claim)", roleName, userId); log.info("OIDC role {} assigned to {} (from token claim)", roleName, userId);
} }
} }
@@ -232,7 +232,7 @@ public class OidcAuthController {
for (String roleName : defaultRoles) { for (String roleName : defaultRoles) {
UUID roleId = SystemRole.BY_NAME.get(SystemRole.normalizeScope(roleName)); UUID roleId = SystemRole.BY_NAME.get(SystemRole.normalizeScope(roleName));
if (roleId != null) { if (roleId != null) {
rbacService.assignRoleToUser(userId, roleId); rbacService.assignManagedRole(userId, roleId, null);
log.debug("Default role {} assigned to {} (no claim mapping or OIDC roles)", roleName, userId); log.debug("Default role {} assigned to {} (no claim mapping or OIDC roles)", roleName, userId);
} }
} }