[BUG] Regex Policy based on multivalued attributes

[immieszko]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

Using keycloak-restrict-client-auth` with Policy-Based mode. When I want to use Regex Client Policy on multivalue attributes it does not work.
For example, I have User user1 with an attribute:

"attr": [
    "1test",
    "2test"
  ],

If I define the target_claim to my_attr and regex pattern to 1test it works, but when I would like to check the 2test I have no idea how to do it 😞. Do you know any solution?

Expected Behavior

Check each value from multivalued attribute not only first.

Steps To Reproduce

1. Create Policy-Based flow,
2. Use Regex policy based on multivalued attribute
3. Check the second value of attribute in Policy

Version

- Keycloak: 24.0.1
- This extension: 24.0.0

Anything else?

No response

[sventorben]

Hey @immieszko

I moved this to the discussion section since this is not a bug within my extension. What you are using there is a default Keycloak feature.
Anyways, I don't think that what you are trying to achieve will work, because the the RegexPolicyProvider will only use the first attribute value. See https://github.com/keycloak/keycloak/blob/24.0.1/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/regex/RegexPolicyProvider.java#L99

I'd recommend you create a feature request at the Keycloak project to support multi-valued attributes here.