Persist admin event only when roles is non-empty

Currently, an adminEvent is created regardless of if the roles passed to the role-mapping API is empty. The event should only be created when the list `roles` is non-empty. Closes keycloak#33195 Signed-off-by: Venkatesh Kannan <[email protected]>
jonkoops · Nov 29, 2024 · 1fae6be · 1fae6be
1 parent babd656
commit 1fae6be
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/services/src/main/java/org/keycloak/services/resources/admin/ClientRoleMappingsResource.java b/services/src/main/java/org/keycloak/services/resources/admin/ClientRoleMappingsResource.java
@@ -183,7 +183,9 @@ public void addClientRoleMapping(List<RoleRepresentation> roles) {
             throw new ErrorResponseException("invalid_request", "Could not add user role or group mappings!", Response.Status.BAD_REQUEST);
         }
 
-        adminEvent.operation(OperationType.CREATE).resourcePath(uriInfo).representation(roles).success();
+        if (!roles.isEmpty()) {
+            adminEvent.operation(OperationType.CREATE).resourcePath(uriInfo).representation(roles).success();
+        }
 
     }
 

diff --git a/services/src/main/java/org/keycloak/services/resources/admin/RoleMapperResource.java b/services/src/main/java/org/keycloak/services/resources/admin/RoleMapperResource.java
@@ -253,7 +253,9 @@ public void addRealmRoleMappings(@Parameter(description = "Roles to add") List<R
             throw new ErrorResponseException("invalid_request", "Could not add user role mappings!", Response.Status.BAD_REQUEST);
         }
 
-        adminEvent.operation(OperationType.CREATE).resourcePath(session.getContext().getUri()).representation(roles).success();
+        if (!roles.isEmpty()) {
+            adminEvent.operation(OperationType.CREATE).resourcePath(session.getContext().getUri()).representation(roles).success();
+        }
     }
 
     /**