diff --git a/model/jpa/src/main/java/org/keycloak/models/policy/conditions/RolePolicyConditionProvider.java b/model/jpa/src/main/java/org/keycloak/models/policy/conditions/RolePolicyConditionProvider.java index 4591255fe25..eb8015220d6 100644 --- a/model/jpa/src/main/java/org/keycloak/models/policy/conditions/RolePolicyConditionProvider.java +++ b/model/jpa/src/main/java/org/keycloak/models/policy/conditions/RolePolicyConditionProvider.java @@ -11,6 +11,7 @@ import org.keycloak.models.RoleModel; import org.keycloak.models.UserModel; import org.keycloak.models.policy.ResourcePolicyConditionProvider; import org.keycloak.models.policy.ResourcePolicyEvent; +import org.keycloak.models.policy.ResourcePolicyInvalidStateException; import org.keycloak.models.policy.ResourceType; import org.keycloak.models.utils.RoleUtils; @@ -51,6 +52,15 @@ public class RolePolicyConditionProvider implements ResourcePolicyConditionProvi return true; } + @Override + public void validate() throws ResourcePolicyInvalidStateException { + expectedRoles.forEach(id -> { + if (session.roles().getRoleById(session.getContext().getRealm(), id) == null) { + throw new ResourcePolicyInvalidStateException(String.format("Role with id %s does not exist.", id)); + } + }); + } + private RoleModel getRole(String expectedRole, RealmModel realm) { boolean isClientRole = expectedRole.indexOf('/') != -1; diff --git a/tests/base/src/test/java/org/keycloak/tests/admin/model/policy/RolePolicyConditionTest.java b/tests/base/src/test/java/org/keycloak/tests/admin/model/policy/RolePolicyConditionTest.java index d21dc69139a..d0588487944 100644 --- a/tests/base/src/test/java/org/keycloak/tests/admin/model/policy/RolePolicyConditionTest.java +++ b/tests/base/src/test/java/org/keycloak/tests/admin/model/policy/RolePolicyConditionTest.java @@ -140,7 +140,7 @@ public class RolePolicyConditionTest { .of(EventBasedResourcePolicyProviderFactory.ID) .onEvent(ResourceOperationType.ROLE_GRANTED.name()) .recurring() - .onCoditions(ResourcePolicyConditionRepresentation.create() + .onConditions(ResourcePolicyConditionRepresentation.create() .of(RolePolicyConditionFactory.ID) .withConfig(attributes) .build())