Unable to disable impersonation #49992

m8426 · 2026-06-13T21:48:21Z

m8426
Jun 13, 2026

I have the following setup in docker compose:

services:
  postgres:
    image: ${POSTGRES_IMAGE}
    environment:
      POSTGRES_DB: ${KC_DB_NAME}
      POSTGRES_USER: ${KC_DB_USERNAME}
      POSTGRES_PASSWORD: ${KC_DB_PASSWORD}
    volumes:
      - kc-postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_interval: 2s
      start_period: 20s
    restart: unless-stopped
    stop_grace_period: 60s

  keycloak:
    image: ${KEYCLOAK_IMAGE}
    command: start
    volumes:
      - ./duo-providers:/opt/keycloak/providers
    environment:
      KC_BOOTSTRAP_ADMIN_USERNAME: ${KC_BOOTSTRAP_ADMIN_USERNAME}
      KC_BOOTSTRAP_ADMIN_PASSWORD: ${KC_BOOTSTRAP_ADMIN_PASSWORD}
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://postgres:5432/${KC_DB_NAME}
      KC_DB_USERNAME: ${KC_DB_USERNAME}
      KC_DB_PASSWORD: ${KC_DB_PASSWORD}
      KC_HOSTNAME: ${KC_HOSTNAME}
      KC_HTTP_ENABLED: ${KC_HTTP_ENABLED}
      KC_PROXY_HEADERS: xforwarded
    mem_limit: 2g
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - default
      - keycloak-net
    restart: unless-stopped

volumes:
  kc-postgres-data:

networks:
  keycloak-net:
    external: true

I have tried adding:

command: start --features-disabled=impersonation

KC_FEATURE_IMPERSONATION: disabled

KC_FEATURES_DISABLED: impersonation

None of these disable impersonation. Do I specifically need a custom image to disable impersonation, or is my config wrong?

MILLERMARRU · 2026-06-27T00:12:03Z

MILLERMARRU
Jun 27, 2026

The env var syntax KC_FEATURES_DISABLED=impersonation is correct for Quarkus-based Keycloak (25+), but in recent versions the impersonation feature flag no longer controls the capability at the server level the way it did in older distributions.

The reliable approach in modern Keycloak is to revoke the impersonation role per realm through the realm-management client:

Via Admin Console:

Select your realm
Go to Clients > realm-management > Roles
Click on the impersonation role
Go to Users in role and remove any users/groups that should not be able to impersonate

To prevent all admins from impersonating, remove impersonation from the realm-admin composite role:

Clients > realm-management > Roles > realm-admin
Associated roles > remove impersonation

Via Admin CLI:

kcadm.sh remove-roles   -r <your-realm>   --rname realm-admin   --cclientid realm-management   --rolename impersonation

This disables impersonation for all realm admins without requiring a server restart or a custom image. If you manage multiple realms, you will need to repeat this per realm.

The --features-disabled=impersonation flag was effective in Keycloak versions prior to ~23. If you are on 25+, the realm-management role approach above is the correct path.

0 replies

Navigation Menu

Repository navigation

Unable to disable impersonation #49992

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Unable to disable impersonation #49992

Uh oh!

m8426 Jun 13, 2026

Replies: 1 comment

Uh oh!

MILLERMARRU Jun 27, 2026

m8426
Jun 13, 2026

MILLERMARRU
Jun 27, 2026