8000
How to Configure Intermediate Proxy IDP Without Local User Storage and How to Add Custom User Attributes? · keycloak keycloak · Discussion #44869 · GitHub
You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
How to Configure Intermediate Proxy IDP Without Local User Storage and How to Add Custom User Attributes?
#44869
I'm developing with two Keycloak instances: one acts as the backend IDP (responsible for actual authentication and login verification), and the other is the portal IDP used by our system. The portal IDP serves as an intermediate proxy IDP that only redirects to the backend IDP via the "Identity Providers" configuration (no local authentication logic).
I have two key questions:
I noticed that the intermediate portal IDP persists user information (e.g., user profiles, tokens, session data) in its local database. I want to prevent it from storing any user data at all — instead, I hope it fetches userinfo data from the backend IDP, processes it (e.g., via a custom SPI), and returns the processed data to the client application, with no additional persistence of user data. Is this achievable?
How can I add extra custom attributes to users in the backend IDP? In the version 26.4.7 of Keycloak I'm using, there is no dedicated "Attributes" tab in the user settings interface (where I manage users), making it impossible to manually add custom user attributes through the admin console.
Additional context:
Keycloak version: [26.4.7]
For the portal IDP, I've tried setting Sync Mode to LEGACY and disabling Store Tokens/Import Users, but I'm not sure if this is sufficient for complete no-local-storage.
For custom attributes, I've checked the user "Profile" and "Details" tabs (no attribute section) and confirmed my admin account has manage-users permissions.
Any guidance, configuration examples, or SPI implementation snippets would be greatly appreciated!
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
I'm developing with two Keycloak instances: one acts as the backend IDP (responsible for actual authentication and login verification), and the other is the portal IDP used by our system. The portal IDP serves as an intermediate proxy IDP that only redirects to the backend IDP via the "Identity Providers" configuration (no local authentication logic).
I have two key questions:
I noticed that the intermediate portal IDP persists user information (e.g., user profiles, tokens, session data) in its local database. I want to prevent it from storing any user data at all — instead, I hope it fetches userinfo data from the backend IDP, processes it (e.g., via a custom SPI), and returns the processed data to the client application, with no additional persistence of user data. Is this achievable?
How can I add extra custom attributes to users in the backend IDP? In the version
26.4.7of Keycloak I'm using, there is no dedicated "Attributes" tab in the user settings interface (where I manage users), making it impossible to manually add custom user attributes through the admin console.Additional context:
manage-userspermissions.Any guidance, configuration examples, or SPI implementation snippets would be greatly appreciated!
All reactions