The function "GetGroups" doesn't return the list of all sub-groups

[hosseinjdk]

Describe the bug
After upgrading the Keycloak from "22.0.4" to "23.0.3", I found out that the gocloak function "GetGroups" only returns the parent groups of a realm. The following code is working perfect with Keycloak-v22.0.4:

func (kcClient *KeyCloakClient) getKeyCloakGroupByPath(realm, path string) (*gocloak.Group, error) 

	groups, err := kcClient.client.GetGroups(context.Background(), kcClient.token.AccessToken, realm, gocloak.GetGroupsParams{})
	if err != nil {
		return nil, err
	}

	for _, group := range groups {
		found := traverseGroup(group, path)
		if found != nil {
			return found, nil
		}
	}
	return nil, errors.New("No Group found")
}

However we upgraded the Keycloak to "23.0.3" and after that the "GetGroups" returns only the parent groups of a realm.

Expected behavior
"GetGroups" should recursively return all groups including all the sub-groups in tree just like before.

Environment:

• Platform: Kubernetes-v1.26.9
• OS: RHEL 8
• Gocloak: v13.8.0
• Keycloak: 23.0.3

[osmian]

@hosseinjdk Does it return the subgroups if you specify the params in the call you make gocloak.GetGroupsParams, specifically making BriefRepresentation false or Full as true.

[hosseinjdk]

@hosseinjdk Does it return the subgroups if you specify the params in the call you make gocloak.GetGroupsParams, specifically making BriefRepresentation false or Full as true.

@osmian Thanks for your answer. I tested my function with these 3 variables as an input for "kcClient.client.GetGroups":

		grpParams := gocloak.GetGroupsParams{
			Full: gocloak.BoolP(true),
		}

		grpParams := gocloak.GetGroupsParams{
			BriefRepresentation: gocloak.BoolP(false),
		}

		grpParams := gocloak.GetGroupsParams{
			BriefRepresentation: gocloak.BoolP(false),
			Full: gocloak.BoolP(true),
		}

All return the same group as a result, I mean only the parent and no subgroups.

[hosseinjdk]

@osmian

The following api is new in keycloak 23.0.0 for this purpose maybe.
GET /admin/realms/{realm}/groups/{id}/children

Keycloak Admin REST API

[osmian]

@hosseinjdk @Nerzal it may be useful to make an MR and add this to the client.go so its available in future releases?

[Nerzal]

Yes, that would make sense.
Keycloak loves to change the behaviour of stuff. It's hard to keep up with all these changes

[robson90]

As already mentioned here, this workaround will work for getting "all" Groups with their SubGroups

client.GetGroups(ctx, token.AccessToken, realm, gocloak.GetGroupsParams{Search: gocloak.StringP("%")})

[tduong2049]

Initial method for getting the child groups of a given group, using documentation from #456 (comment)

// client.go

// GetChildGroups get child groups of group with id in realm
func (g *GoCloak) GetChildGroups(ctx context.Context, token, realm, groupID string) ([]*Group, error) {
	const errMessage = "could not get child groups"

	var result []*Group

	resp, err := g.getRequestWithBearerAuth(ctx, token).
		SetResult(&result).
		Get(g.getAdminRealmURL(realm, "groups", groupID, "children"))

	if err := checkForError(resp, err, errMessage); err != nil {
		return nil, err
	}

	return result, nil
}

This method could be modified in the future to include a GetChildGroupsParams parameter

// client.go

// GetChildGroups get child groups of group with id in realm
func (g *GoCloak) GetChildGroups(ctx context.Context, token, realm, groupID string, params GetChildGroupsParams) ([]*Group, error) {
	const errMessage = "could not get child groups"

	var result []*Group
	queryParams, err := GetQueryParams(params)
	if err != nil {
		return nil, errors.Wrap(err, errMessage)
	}

	resp, err := g.getRequestWithBearerAuth(ctx, token).
		SetResult(&result).
		SetQueryParams(queryParams).
		Get(g.getAdminRealmURL(realm, "groups", groupID, "children"))

	if err := checkForError(resp, err, errMessage); err != nil {
		return nil, err
	}

	return result, nil
}

// models.go

// GetChildGroupsParams represents the optional parameters for getting child groups
type GetChildGroupsParams struct {
	First               *int    `json:"first,string,omitempty"`
	Max                 *int    `json:"max,string,omitempty"`
	BriefRepresentation *bool   `json:"briefRepresentation,string,omitempty"`
}

[hosseinjdk]

As already mentioned here, this workaround will work for getting "all" Groups with their SubGroups

client.GetGroups(ctx, token.AccessToken, realm, gocloak.GetGroupsParams{Search: gocloak.StringP("%")})

Thank you very much. This workaround works.