how to prevent users from adding custom attributes in Keycloak registration?

user_11762199 0
Viewed 82

according to the Keycloak docs to add custom user attributes we can edit registration template, for example, add the following snippet to the form:

<div class="form-group">
   <div class="${properties.kcLabelWrapperClass!}">
       <label for="user.attributes.mobile" class="${properties.kcLabelClass!}">Mobile number</label>
   </div>

   <div class="${properties.kcInputWrapperClass!}">
       <input type="text" class="${properties.kcInputClass!}" id="user.attributes.mobile" name="user.attributes.mobile" value="${(register.formData['user.attributes.mobile']!'')}"/>
   </div>
</div>

with this, the custom attribute (mobile) was added to the user. but the user (unregistered user) has full control over these custom attributes, the user can inspect and edit the HTML page to add any other custom attribute (or edit), by changing id and name.

how to prevent users from doing this?

enter image description here

enter image description here

keycloak
1 Answers

I deleted my own previous answer in favour of this one, as there are possibilities to mitigate this:

you could either use the "declarative user profile" feature, more on that here: https://www.keycloak.org/docs/latest/server_admin/#defining-a-user-profile

With this feature enabled, unknown fields are not going to get evaluated/persisted, only the fields known in the profile template.

Alternatively, you can implement the FormAction SPI to add your own validations. See here for more on that.

user_13415990
Related