Bug 58254 - add basic scope to oidc clients in univention-keycloak
Summary: add basic scope to oidc clients in univention-keycloak
Status: CLOSED FIXED
Alias: None
Product: UCS
Classification: Unclassified
Component: Keycloak
Version: UCS 5.2
Hardware: Other Linux
: P5 normal
Target Milestone: UCS 5.2-1-errata
Assignee: Felix Botner
QA Contact: Florian Best
URL:
Keywords:
Depends on:
Blocks: 58255
  Show dependency tree / graph
 
Reported: 2025-05-09 15:48 CEST by Felix Botner
Modified: 2025-05-15 12:38 CEST (History)
0 users

See Also:
What kind of report is it?: Development Internal
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Customer ID:
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Felix Botner univentionstaff 2025-05-09 15:48:35 CEST 
To interact with the guardian, we need to authenticate via OIDC. Guardian needs the sub claim, which is by default not added to tokens for clients created with univention-keycloak.

-> add basic scope as default scope when creating oidc clients with univention-keycloak
Comment 1 Felix Botner univentionstaff 2025-05-09 16:06:36 CEST 
7f82ad5c6266f0225a10a432967489b352699838 - add basic scope
094edcfe653e27a4ba63ba8a2a3366fcda2ef9d6 - advisory

Successful build
Package: univention-keycloak
Version: 3.0.29
Branch: 5.2-0
Scope: errata5.2-1
User: fbotner
Comment 2 Florian Best univentionstaff 2025-05-12 12:35:02 CEST 
OK: basic scope gets added for oidc/rp clients
OK~: advisory (wording adjusted in git:906d3ab4d2a)
FAIL: commit message doesn't reference bug number: git log --grep 58254 origin/5.2-1
FAIL: There is no way to update existing clients. It could cause problems for clients already created by joinscripts, which never receive the update and we have to debug the issue then.
→ not changeable, therefor VERIFIED
Comment 3 Christian Castens univentionstaff 2025-05-15 12:38:02 CEST 
<https://errata.software-univention.de/#/?erratum=5.2x89>