Repository navigation
Why is Keycloak unable to store its own user data without importing users from the User Storage Provider #44423
ericmorand
started this conversation in
Ideas
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
I'm reading the documentation about User Storage Provider and there is something that I'm not able to understand. The documentation says that Keycloak can't save user profile attributes and many other things if we don't import the users from the User Storage Provider. It does not make sense to me.
Keycloak has its own private concept of User. It comes with custom attributes, signin configuration (OTP, passkeys...), and so on. The User Storage Providers have their own private concept of User, known to Keycloak only from the User Storage Provider configuration.
Conceptually, a Keycloak User comes with a relationship to an External User. This External User is a compound of an identifier and a User Storage Provider.
User --------------------------(0, 1) External User (an identifier and an User Storage Provider identifier)
Whenever Keycloak needs to access or mutate something that belongs to the concept of User, it does so in its own database. Whenever it needs to access or mutate something that belongs to the concept of External User, it does so from the User Storage Provider.
Which means that its is able to store OTP configuration and custom attributes in its own database while still being able to get the username and password from the User Storage Provider.
Why is the documentation saying that it is not possible without importing the whols User Storage Provider into Keycloak? Is the documentation wrong, or is Keycloak conceptual model flawed?
EDIT: I tested the User Storage Simple read-only flavor and it confirms that the issue is not from the documentation: the User Storage Provider has to support everything exposed by the Keycloak concept of User. In other words, it is a substitute to Keycloak User entity. Am I missing somehting or is it a huge oversight? Why isn't Keycloak able to store its own data into its own database, regardless of what the external storage supports?
All reactions