Repository navigation
What to do about Foreign Users in Belgium with (DECL.:) as part of their lastname? #49689
Replies: 1 comment
|
The validator probably exists as an additional preventive measure against some injection attacks. Also, since names don't (normally) contain special characters, the validator is there to ensure that someone doesn't add characters that don't make sense by mistake. About changing the validator, you can take a look whether you can implement an SPI to override the default functionality - https://www.keycloak.org/docs/latest/server_development/index.html. Unfortunately I don't have any experience with overriding functionality, so I can't help you with the code. For the last question, you may be able to use a mapper to strip out the prefix - https://www.keycloak.org/docs/latest/server_admin/index.h 8000 tml#_mappers when the user is imported. However, this sounds like it may cause some issues since you are dealing with legal IDs from my understanding. |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
In Belgium we use a government E-ID system that contains the names and Identification numbers for all citizens. Citizens can use it to access digital systems using their government Id.
When a person immigrates to Belgium but is not able to provide proof of their identity their lastnames are considered to be "declared".
Meaning "the person claims to be called ..." This results in a prefix
(DECL.:)being added to their lastname in the citizen registry.Meaning a person with the lastname
Simpsonwill have the legal lastname (according to our national identity system) `(DECL.:)Simpson". This webpage contains more information.This is off course a problem for Keycloak since it validates lastnames using a built in PersonNameValidator which does not allow parentheses
(). Meaning these users cannot use our services.What makes it more complicated is the fact that Keycloak doesn't use this validator when a user is being imported from an external identity provider.
In our system a new user log's in with a Belgian E-ID solution called It's Me. This automatically registers the user and Keycloak imports it without validating the lastname. In my app the user then needs to accept the terms of service. Doing this will trigger a user update API call to Keycloak, where we attempt to set a
last-accepted-tosuser-attribute containing the timestamp. Since this happens with a HTTP PUT call at/admin/realms/{realm}/users/{user-id}, the user object is validated and get's rejected by the PersonNameValidator in Keycloak, even though the user already exists in the keycloak database with that name.I have thew following questions:
(DECL.:)out?All reactions