Repository navigation
How to prevent a SPI from being disabled ? #42578
|
I developed a custom SPI + a provider, I don't want the Keycloak admin to disable it via command line Is there a recommended way to enforce this, so that my provider cannot be disabled by admin configuration? |
Replies: 1 comment 2 replies
Not currently. The expectation is that anyone with the ability to configure the command line has full control over the instance. Can you discribe the scenario why you wouldn't want this configurable? And are you looking to prevent that same admin from misconfiguring other things such as ports or TLS settings? |
|
yes, exactly, Keycloak is embedded in the product and we don't want the customer to modify any of its configuration |
|
If I understand correctly you have a class of admin user, who does not have write access to the Keycloak install, but does have permissions to run kc.sh and you don't want them to be able to pass cli options or environment properties? If you want to try to do something like this, then don't allow access to kc.sh either. Instead create your own launch script that does not accept whatever you want to forbid as cli parameters and clears the env of the same. |
If I understand correctly you have a class of admin user, who does not have write access to the Keycloak install, but does have permissions to run kc.sh and you don't want them to be able to pass cli options or environment properties?
If you want to try to do something like this, then don't allow access to kc.sh either. Instead create your own launch script that does not accept whatever you want to forbid as cli parameters and clears the env of the same.