Keycloak user attributes on profile update cleaned - how to persist and only editable by admins
Marc-André Momm
Hi all,
I'm setting several custom attributes for the users within the API by an custom application.
Problem is, my custom attributes are deleted, whenever the user updates his profile. Possible also in other situations. I'm wondering about that. Especially, because accepting terms & conditions (standard functionality) is also stored in an custom attribute, that then is also been deleted?!
So I was searching for a solution and only found only overwriting the UpdateProfile class. If you have other solutions, I would be very happy.
--------------------------------
In case of UpdateProfile:
So, now I only want to allow users or clients with realm management role --> manage users role to change this attributes. Otherwise keep them as they are.
So I've searched and found out, that overwriting the UpdateProfile function seems to be the best. But I don't know how to do the upper check against the "manage users" role. This is my first question.
Second question is, that I'm not sure, how to deploy this script into Keycloak and install it. Can I deploy this on any way as JAR via /opt/jboss/keycloak/standalone/deployments ? As I'm using the docker environment with keycloak, I don't want to edit standalone etc. directly...
Thank you very much in advance.
public class UpdateProfile implements RequiredActionProvider, RequiredActionFactory,
DisplayTypeRequiredActionFactory {
@Override
public InitiatedActionSupport initiatedActionSupport() {
return InitiatedActionSupport.SUPPORTED;
}
@Override
public void evaluateTriggers(RequiredActionContext context) {
}
@Override
public void requiredActionChallenge(RequiredActionContext context) {
Response challenge = context.form()
.createResponse(UserModel.RequiredAction.UPDATE_PROFILE);
context.challenge(challenge);
}
// Check the custom attribute 1 not being modified by the user
@Override
public void processAction(RequiredActionContext context) {
EventBuilder event = context.getEvent();
event.event(EventType.UPDATE_PROFILE);
MultivaluedMap<String, String> formData = context.getHttpRequest().getDecodedFormParameters();
UserModel user = context.getUser();
KeycloakSession session = context.getSession();
RealmModel realm = context.getRealm();
String newYourCustomAttribute1 = formData.getFirst("yourCustomAttribute1");
String oldYourCustomAttribute1 = user.getFirstAttribute("yourCustomAttribute1")
if (!newYourCustomAttribute1.equals(oldYourCustomAttribute1)) {
Response challenge = context.form()
.setError("User cannot change the attribute")
.setFormData(formData)
.createResponse(UserModel.RequiredAction.UPDATE_PROFILE);
context.challenge(challenge);
return;
}
context.success();
}
@Override
public void close() {
}
@Override
public RequiredActionProvider create(KeycloakSession session) {
return this;
}
@Override
public RequiredActionProvider createDisplay(KeycloakSession session, String displayType) {
if (displayType == null) return this;
if (!OAuth2Constants.DISPLAY_CONSOLE.equalsIgnoreCase(displayType)) return null;
return ConsoleUpdateProfile.SINGLETON;
}
@Override
public void init(Config.Scope config) {
}
@Override
public void postInit(KeycloakSessionFactory factory) {
}
@Override
public String getDisplayText() {
return "Update Profile";
}
@Override
public String getId() {
return UserModel.RequiredAction.UPDATE_PROFILE.name();
}
}
Hind Rhanoui
Marc-André Momm
--
You received this message because you are subscribed to a topic in the Google Groups "Keycloak User" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/keycloak-user/m97Gzu8pPK8/unsubscribe.
To unsubscribe from this group and all its topics, send an email to keycloak-use...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/keycloak-user/b6d25e57-c5ef-4c75-b43a-abdcd604aa97n%40googlegroups.com.