Corrected the logic of the Keycloak default client level roles assign…

…ment synchronization.

CHANGELOG.md

@@ -18,7 +18,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 
 ### Fixed
 
-- Stale client level roles assignment, if all roles of the client are removed in configuration. The Keycloak default client roles (e.g. realm-management) will remain untouched though.
+- Stale client level roles assignment on a user, if the client is not present in the `clientRoles` JSON object in the config file.
+  The Keycloak default client roles (e.g. realm-management) will remain untouched though.
 
 
 ## [4.3.0] - 2021-09-28

src/main/java/de/adorsys/keycloak/config/service/UserImportService.java

@@ -266,14 +266,15 @@ private void handleClientRoles() {
                     .getUserClientLevelRoles(realmName, userToImport.getUsername());
 
             for (Map.Entry<String, List<String>> existing : existingClientsRoles.entrySet()) {
-                List<String> rolesToImport = clientRolesToImport.getOrDefault(existing.getKey(), Collections.emptyList());
+                List<String> rolesToImport = clientRolesToImport.get(existing.getKey());
 
-                if (rolesToImport.isEmpty()) {
+                if (rolesToImport == null) {
                     ClientRepresentation client = clientRepository.getByClientId(realmName, existing.getKey());
                     if (KeycloakUtil.isDefaultClient(client)) {
-                        // Do not remove keycloak default client's roles even if they are not in configuration
+                        // Do not remove keycloak default client's roles when they are not in the configuration
                         continue;
                     }
+                    rolesToImport = Collections.emptyList();
                 }
                 setupClientRoles(
                         existing.getKey(),

src/test/java/de/adorsys/keycloak/config/service/ImportUsersIT.java

@@ -589,6 +589,32 @@ void shouldRemoveClientLevelRolesFromExistingServiceAccount() throws IOException
         assertThat(keycloakNativeClientLevelRoles, contains("view-realm"));
     }
 
+    @Test
+    @Order(100)
+    void shouldRemoveKeycloakDefaultClientLevelRolesFromExistingServiceAccount() throws IOException {
+        doImport("60.3_update_realm_explicitly_remove_keycloak_client_role_from_service_account.json");
+        RealmRepresentation realm = keycloakProvider.getInstance().realm(REALM_NAME).toRepresentation();
+        assertThat(realm.getRealm(), is(REALM_NAME));
+        assertThat(realm.isEnabled(), is(true));
+        assertThat(realm.isRegistrationAllowed(), is(true));
+        assertThat(realm.isRegistrationEmailAsUsername(), is(true));
+
+        ClientRepresentation client = keycloakRepository.getClient(REALM_NAME, "technical-client");
+        assertThat(client.getClientId(), is("technical-client"));
+
+        UserRepresentation user = keycloakProvider.getInstance().realm(REALM_NAME)
+                .clients()
+                .get(client.getId())
+                .getServiceAccountUser();
+
+        assertThat(user.getUsername(), is("service-account-technical-client"));
+
+        List<String> keycloakNativeClientLevelRoles = keycloakRepository.getServiceAccountUserClientLevelRoles(
+                REALM_NAME, client.getClientId(), "realm-management");
+
+        assertThat(keycloakNativeClientLevelRoles, empty());
+    }
+
     private List<GroupRepresentation> getGroupsByUser(UserRepresentation user) {
         return keycloakProvider.getInstance().realm(REALM_NAME).users().get(user.getId()).groups();
     }

src/test/resources/import-files/users/60.3_update_realm_explicitly_remove_keycloak_client_role_from_service_account.json

@@ -0,0 +1,76 @@
+{
+  "enabled": true,
+  "realm": "realmWithUsers",
+  "registrationAllowed": true,
+  "registrationEmailAsUsername": true,
+  "roles": {
+    "client": {
+      "moped-client": [
+        {
+          "name": "test_client_role",
+          "description": "My moped-client role",
+          "composite": false,
+          "clientRole": true
+        },
+        {
+          "name": "other_test_client_role",
+          "description": "My changed other moped-client role",
+          "composite": false,
+          "clientRole": true
+        }
+      ]
+    }
+  },
+  "clients": [
+    {
+      "clientId": "technical-client",
+      "surrogateAuthRequired": false,
+      "enabled": true,
+      "alwaysDisplayInConsole": false,
+      "clientAuthenticatorType": "client-secret",
+      "redirectUris": [],
+      "webOrigins": [],
+      "notBefore": 0,
+      "bearerOnly": false,
+      "consentRequired": false,
+      "standardFlowEnabled": false,
+      "implicitFlowEnabled": false,
+      "directAccessGrantsEnabled": false,
+      "serviceAccountsEnabled": true,
+      "publicClient": false,
+      "frontchannelLogout": false,
+      "protocol": "openid-connect",
+      "defaultClientScopes": [
+        "role_list",
+        "roles"
+      ],
+      "optionalClientScopes": []
+    },
+    {
+      "clientId": "moped-client",
+      "name": "moped-client",
+      "description": "Moped-Client",
+      "enabled": true,
+      "clientAuthenticatorType": "client-secret",
+      "secret": "my-special-client-secret",
+      "bearerOnly": true
+    }
+  ],
+  "users": [
+    {
+      "username": "service-account-technical-client",
+      "enabled": true,
+      "totp": false,
+      "emailVerified": false,
+      "serviceAccountClientId": "technical-client",
+      "clientRoles": {
+        "account": [
+          "manage-account",
+          "view-profile"
+        ],
+        "realm-management": []
+      },
+      "notBefore": 0
+    }
+  ]
+}