Repository navigation
"Attempt to edit denied attribute" error when creating new user with Active Directory federation #15778
Replies: 1 comment 1 reply
|
Hi, I have a similar issue on updating users. It's dosent matter what is changed of the user (enable/disable, name, e-mail adress, password, ...). It's not a persistent error. It's possible to retry the same action several times and sometimes it will work. It also affects only few users. Same action on other user will work, but affected users changes over time. The issue here is a little bit older. Did you find any working solution? 8000 |
|
Hi there! Apologies for necroposting. I'm also running into that annoying issue with a custom JPA user federation I built. I also found that it seems to be caching-related, because when I turn off the custom user federation cache, I can correctly save users. Did you guys find any solution/workaround for this issue? Thanks in advance! |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
I'm trying to get federation with my AD server working but I'm getting these errors (please ignore my silly test name):
2022-12-01 00:00:21,235 WARN [org.keycloak.userprofile.validator.ReadOnlyAttributeUnchangedValidator] (executor-thread-140) Attempt to edit denied attribute '(?i:^\QKERBEROS_PRINCIPAL\E$|^\QLDAP_ID\E$|^\QLDAP_ENTRY_DN\E$|^\QCREATED_TIMESTAMP\E$|^\QcreateTimestamp\E$|^\QmodifyTimestamp\E$|^\QuserCertificate\E$|^\Qsaml.persistent.name.id.for.\E.$|^\QENABLED\E$|^\QEMAIL_VERIFIED\E$|^\QdisabledReason\E$)' of user 'testimann'$|^\QENABLED\E$ |^\QEMAIL_VERIFIED\E$|^\QdisabledReason\E$)' of user 'testimann'
2022-12-01 00:00:21,235 WARN [org.keycloak.userprofile.validator.ReadOnlyAttributeUnchangedValidator] (executor-thread-140) Attempt to edit denied attribute '(?i:^\QKERBEROS_PRINCIPAL\E$|^\QLDAP_ID\E$|^\QLDAP_ENTRY_DN\E$|^\QCREATED_TIMESTAMP\E$|^\QcreateTimestamp\E$|^\QmodifyTimestamp\E$|^\QuserCertificate\E$|^\Qsaml.persistent.name.id.for.\E.
2022-12-01 00:00:58,344 WARN [org.keycloak.events] (executor-thread-144) type=UPDATE_PASSWORD_ERROR, realmId=33b05f38-92fd-42c2-aa87-22eb746b6c0a, clientId=account-console, userId=474c93d5-afcf-4673-ace2-bb8e3f9dcf33, ipAddress=192.168.86.1, error=password_rejected, reason='Could not modify attribute for DN [CN=testimann,OU=ServiceUsers,DC=domain,DC=example,DC=net]', auth_method=openid-connect, custom_required_action=UPDATE_PASSWORD, response_type=code, redirect_uri=https://auth.example.net/realms/examplenetwork/account/#/, remember_me=false, code_id=5a2249e3-2b83-4b92-b8b6-a881f116fb06, response_mode=fragment, username=testimann, authSessionParentId=5a2249e3-2b83-4b92-b8b6-a881f116fb06, authSessionTabId=0h8bOUIDCpI
Does anyone have advice to fix this? Currently, when trying to create an account. this happens:
and then this:
Thanks in advance
All reactions