- 🇧🇪Belgium BramDriesen Belgium 🇧🇪
I will need to have a look at how other OpenID Connect providers are handling this. Revoking and Re-adding all roles on each logins seems like an "expensive" operation.
When you revoke a certain role of a user in Keycloak, this change is not reflected to the user in Drupal. This is maybe a rarer use case but it is not the expected behaviour, and we need to do the role mapping properly.
Let’s test with the following scenario:
We have two groups of users in Keycloak: Admins & Editors. The Admins group has the drupal-admin role assigned, while the Editors group has the drupal-editor role. On our Drupal website we have two corresponding roles: administrator & editor. We also have the role mapping config already set up and working.
Revoke all user roles before mapping them in Drupal. In this way, we make sure that all changes to the user roles made via Keycloak match those in Drupal.
This problem has already been discussed in the following issue on the OpenID Connect / OAuth client project for version 2.x-dev: Revoking group access does not reflect on applied roles → .
I am simply providing the fix for our version here and inside the Keycloak module's role matcher service instead.
Needs review
2.2
Code
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
I will need to have a look at how other OpenID Connect providers are handling this. Revoking and Re-adding all roles on each logins seems like an "expensive" operation.