Custom read-only user attributes

[Björn Eickvonder]

Hi,

I have a question regarding custom read-only user attributes.

The documentation 

https://www.keycloak.org/docs/latest/server_admin/index.html#_read_only_user_attributes

states that I should configure the "legacy-user-profile", but the testsuite on GitHub

https://github.com/keycloak/keycloak/blob/main/testsuite/integration-arquillian/servers/auth-server/jboss/common/jboss-cli/keycloak-server-subsystem.cli

uses "declarative-user-profile". What is the difference? Which one is correct?

Additionally I'm struggling with the difference between read-only-attributes and admin-read-only-attributes. Regarding custom attributes I can only change them in the admin console anyway right? So what is the purpose of the read-only-attributes property? Is it only relevant in case of a custom account console theme displaying further attributes?

Björn

[Björn Eickvonder]

Additionally I also discovered a bug. If I set an attribute as a list of values, it is displayed as "value1##value2" in the admin console. If it is read-only I can still change value2, it only fails if I try to change value1.