Problem enabling Keycloak read-only user attributes

user_9801997 0
Viewed 566

I've attempted to enable Read-only user attributes in Keycloak as per the docs: https://www.keycloak.org/docs/latest/server_admin/ However the documented configuration does not actually prevent a user from changing their attributes.

Using Keycloak 15.0.0 with the regular Docker image from docker hub Made a .cli file and added it to my Docker image, built from

FROM jboss/keycloak:15.0.0
ADD RESTRICT_USER_ATTRIBUTES.cli /opt/jboss/startup-scripts/

With contents of RESTRICT_USER_ATTRIBUTES.cli:

embed-server --server-config=standalone-ha.xml --std-out=echo

batch

/subsystem=keycloak-server/spi=userProfile/:add
/subsystem=keycloak-server/spi=userProfile/provider=legacy-user-profile/:add(properties={},enabled=true)
/subsystem=keycloak-server/spi=userProfile/provider=legacy-user-profile/:map-put(name=properties,key=read-only-attributes,value=[myUserAttribute])

run-batch

stop-embedded-server

The .cli file is processed according to the log. I can exec into the docker instance and check the configuration using jboss-cli.sh. But the end user can freely edit myUserAttribute using Postman or another tool.

What am i doing wrong here?

keycloak docker
1 Answers

I just had this issue, and it seems the documentation is out-of-date. They changed the provider name, probably in 15.0.0.

Try changing your cli script to:

# ...

/subsystem=keycloak-server/spi=userProfile/:add
/subsystem=keycloak-server/spi=userProfile/provider=declarative-user-profile/:add(properties={},enabled=true)
/subsystem=keycloak-server/spi=userProfile/provider=declarative-user-profile/:map-put(name=properties,key=read-only-attributes,value=[myUserAttribute])

# ...
user_175425560
Related