Repository navigation
Replies: 1 comment
|
Same issue here, I'd like to be able to prepopulate a list of users and assign them permissions before they're created in my realm. |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
I have set up a keycloak and created a realm. In the realm I have configured the Kerberos user federation provider.
I have the "Allow password logon" and "Update profile on first logon" options configured.
Having done so, I can authenticate to the keycloak realm using my domain password, as expected. Having authenticated to keycloak, a user is created automatically in keycloak. So that bit all works.
If I try and create a new user in keycloak manually, it then appears to check whether that user exists by using the kerberos connection, and refuses to let me create a user if it does.
What I had hoped to be able to do is prepopulate keycloak with users such that when they then authenticate it would connect the user that I had created manually with the logon attempt. I thought that this was how keycloak worked with "social" providers like facebook or github? That the users could exist beforehand? I may have got that wrong though. Perhaps this is the difference between a "user federation provider" and an "identity provider"?
Why do I want to do this?
The trouble with only creating users as they log on is that you can't then, for example, create groups and populate them with users until those users have logged on. I wouldn't be able to set a user up so that they were in appropriate groups before they log on. If using keycloak as the user database for a piece of software for example, I can only reference users that have been "seen" by keycloak. Lets user JIRA as an analogy. I would only be able to assign a ticket to a user if that user had already logged on to JIRA. I'd like to be able assign a JIRA ticket to a user even though they might not yet have logged into JIRA. They then get an email saying someone has assigned them a ticket, log in, and there it is.
It's unclear whether this is deliberate behaviour or not, or whether this is something that could be considered as an enhancement?
All reactions