Client Fine Grained permissions 'extra_config' only sometimes works. KC 24.0.5

[bradhead]

I was trying to add a client token exchange policy, and it would fail. I discovered I need to set the extra config:

  resource "keycloak_openid_client " "client_pas_rs" {
   ...
   service_accounts_enabled     = true

    extra_config = {
      "authorizationServicesEnabled" = true
      "fineGrainAuthorizationEnabled" = true
    }
  }

When I did then performed an apply the policy resource applied correctly and all good. Token exchange client poilcy setup correct.

then I tore down and rebuilt from scratch, and this time the extra configuration had no effect and the policy resource failed. I have to manually toggle the fine grained permissions then re-run the terraform.

Here's the policy that fails when the above toggle is not applied. Note that I have a depends_on set for this.>

resource "keycloak_openid_client_client_policy" "pas_client_policy" {
  realm_id           = data.keycloak_realm.realm.id
  resource_server_id = data.keycloak_openid_client.realm_management.id
  name               = "token-exchange-policy"
  logic              = "POSITIVE"
  decision_strategy  = "UNANIMOUS"
  clients = [
    keycloak_openid_client.client_pas_mulesoft.id
  ]
  depends_on = [keycloak_openid_client.client_pas_rs, keycloak_openid_client.client_pas_mulesoft ]
}

Not sure why it is so inconsistent.

[grolingm-VU]

Hi,
I don't know if this still helps you but maybe someone else is struggeling with the same problem. A colleague of mine had this workaround:

# Workaround for activating the "Permissions" in the "realm-management" client.
# This should actually happen automatically when creating "keycloak_openid_client_permissions", see:
# https://registry.terraform.io/providers/emersonkoppco/keycloak/latest/docs/resources/openid_client_permissions
# However, there is a circular dependency between "keycloak_openid_client_permissions" and
# "keycloak_openid_client_client_policy".
# First, the "keycloak_openid_client_permissions" resource needs to be created. However, this requires the
# "keycloak_openid_client_client_policy" resource, which in turn does not activate the permissions.
resource "keycloak_openid_client_permissions" "dummy_to_activate_permissions" {
  realm_id  = var.keycloak_realm_id
  client_id = data.keycloak_openid_client.realm_management.id

  view_scope {
    policies          = []
    description       = "Dummy permission to activate fine grained permissions on 'realm-management' client."
    decision_strategy = "UNANIMOUS"
  }
}