Repository navigation
Before reporting an issue
Areaimport-export Describe the bugI am importing a realm with the keycloak operator as described in the docs. In this realm import, I also specified which users should be created, see the apiVersion: k8s.keycloak.org/v2alpha1
kind: KeycloakRealmImport
metadata:
labels:
app: auth
name: vantage6-auth-realm-import
namespace: default
spec: │
keycloakCRName: test-auth-kc
realm: test-realm
users:
username: admin
credentials:
- type: password
value: my-super-secret-admin-passwordAs expected, the realm and the user are created. However, I ran into this issue that the user is not given have the default realm roles. I.e. if I go to the admin UI -> go to new realm -> users -> user created via realm import -> role mapping, this is empty. I'd expect to see a role Any subsequent user that I create in the realm is given the Could it be that the user is created before the default realm role and therefore does not receive it? Workaround My temp workaround is to just assign the rules directly to the user in my realm config: ...
users:
- username: admin
...
clientRoles:
account:
- manage-account
- view-profileVersion26.4.7 Regression
Expected behaviorUsers defined in the realm import get the default realm roles Actual behaviorUsers defined in realm import get no permissions whatsoever (unless explicitly specified) How to Reproduce?Use above yaml for a keycloak realm import using the keycloak operator (see getting start docs -> operator. Anything else?No response |
Replies: 1 comment 4 replies
|
Moved from an issue to a discussion. Also the import logic used by the operator should not be introducing anything special here. Can you confirm you see the same behavior when importing without the operator? |
|
Yes I can confirm this is not limited to the operator. I reproduced the issue as follows: ./bin/kc.sh start-dev --import-realmwhere I had this file in {
"realm": "test-realm",
"users": [
{
"username": "admin",
"credentials": [
{
"type": "password",
"value": "my-super-secret-admin-password"
}
]
}
]
}User That makes it indeed a lot simpler than my original post - had never run keycloak outside of kubernetes yet! |
|
I belive the the import / export logic was generally developed to function as a pair. So import logic nominally expects an export - meaning it mostly needs explicit, not implicit defaults. The false values in this call Since this behavior isn't explicitly documented, feel free to open an enhancement request that references this discussion. It will take even more discussion though as there could be quite a few places like this in import logic (the other false parameter in the call above omits the default required actions), and we also wouldn't want anything to be a breaking change. |
|
That's clear. This discussion helped me realize that the solution for me is simply to add for every user. This fixes my original issue. I think you are in a better position to judge if this is an important enough improvement to Keycloak (and if someone has time to implement it). If you think this is important, I'm happy to help by creating an enhancement issue. |
If you are good, then no issue is needed yet. |
I belive the the import / export logic was generally developed to function as a pair. So import logic nominally expects an export - meaning it mostly needs explicit, not implicit defaults.
The false values in this call
keycloak/model/storage-private/src/main/java/org/keycloak/storage/datastore/DefaultExportImportManager.java
Line 978 in 1d16429
Since this behavior isn't explicitly documented, feel free to open an enhancement request that references this discussion. It will take even more discussion tho…