membphis commented on PR #14098: URL: https://github.com/apache/apisix/pull/14098#issuecomment-6433755344
### [P1] Normalize scopes before sending the authorization request - **Problem:** `parse_permission()` trims surrounding whitespace from scopes only during local grant validation, while the token request still sends the original `permission` strings. The existing `http_method_as_scope` path also appends `", " .. scope`, so the sent scope can be `" GET"` while the gateway validates `"GET"`. - **Why this blocks merge:** Legitimate multi-scope and method-scope requests return 403 instead of 200, including the PR's own expected-success cases. The failure persists on the automatic rerun. - **Impact:** Routes using whitespace-separated scopes after a comma, or HTTP method mapping on a static permission that already has a scope. - **Trigger:** For example, `permissions=["course_resource#view, delete"]`, or `permissions=["course_resource#view"]` with `http_method_as_scope=true`. - **Suggested fix:** Parse and normalize a copied permission list before sending it to Keycloak, then encode scopes with commas and no surrounding whitespace. Use the same encoding for HTTP method scopes, preserve all configured scopes, and keep both allowed and denied regression cases passing against real Keycloak. **Evidence at reviewed head `47999333788182f21f5a269ef8dbe60fd2912ef3`:** [local parsing](https://github.com/apache/apisix/blob/47999333788182f21f5a269ef8dbe60fd2912ef3/apisix/plugins/authz-keycloak.lua#L560-L570), [method scope construction](https://github.com/apache/apisix/blob/47999333788182f21f5a269ef8dbe60fd2912ef3/apisix/plugins/authz-keycloak.lua#L653-L665), and [the outgoing token request](https://github.com/apache/apisix/blob/47999333788182f21f5a269ef8dbe60fd2912ef3/apisix/plugins/authz-keycloak.lua#L684-L691). [CI and its automatic rerun](https://github.com/apache/apisix/actions/runs/40316821699/job/121551388491) both show these mismatches in `t/plugin/authz-keycloak3.t TEST 4`: ```text multi scope, teacher: expected 200, actual 403 method scope GET, student: expected 200, actual 403 method scope DELETE, teacher: expected 200, actual 403 ``` The whitespace mismatch is a high-confidence explanation of these failures: [Keycloak 16.1.1's token endpoint](https://github.com/keycloak/keycloak/blob/16.1.1/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenEndpoint.java) splits the scope string on commas without trimming. An isolated check of the actual PR's Lua matching code also confirms that returned scopes with leading whitespace do not match the trimmed scope names. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
