[keycloak-user] Extending Keycloak DB schema (JPA)

[Pavel Micka]

Hello everyone,

We are in situation, when we need to extend KC data model. The issue is that in our domain some users have a special relation with groups. Its something like "Joe supervises groups 1, 2, 3 (and Joe may not be part of group 1, 2 or 3)".
And since Joe may supervise many groups (hundreds) and we want to have data integrity, we have decided the best approach is to extend KC database schema (rather than misuse user attributes :-)).

We investigated the examples and documentation and found out the following statement:
"This is an unsupported API, which means you can use it but there is no guarantee that it will not be removed or changed without warning."
https://www.keycloak.org/docs/latest/server_development/index.html#_extensions_jpa

So we have few questions

  1.  Is it safe to use this API?
  2.  If it will be removed, will it be replaced with some alternative API? (or are there already plans to remove this API?)
  3.  Is there some suggested cleaner way of how to achieve our goal?

Thanks for your help,

Pavel