<p dir="ltr"><br>
On Oct 5, 2015 21:03, "Stan Silvert" <<a href="mailto:ssilvert@redhat.com">ssilvert@redhat.com</a>> wrote:<br>
><br>
> I'm actually starting on the design and implementation of this right now. It's import/export from the admin console. It will also have the ability to import/export partial pieces of a realm such as just users.<br>
><br>
> Thanks for the comments so far on this thread. They have been very helpful.<br>
><br>
> We will keep the idea that no secrets should ever be exported from admin console. I'm not sure that having a flag for it in keycloak-server.json helps. To edit keycloak-server.json, you need access to the server, in which case you might as well do the current import/export.<br>
><br>
> So what do you do after you import a user with no credentials? Some ideas:<br>
> * The administrator can reset the password manually.<br>
> * The user can do password recovery (if enabled)<br>
><br>
> An other ideas?</p>
<p dir="ltr">It'd be helpful if one could use exported realms as a template allowing you to overwrite some properties such as the realm name when importing. I know you can do it manually by editing the file which is why I haven't suggested it earlier. Also allowing you to control with toggles whether to keep or regenerate keys and secrets would be useful.</p>
<p dir="ltr">Best regards,<br>
Thomas<br><br><br><br></p>
<p dir="ltr">><br>
> Stan<br>
><br>
><br>
> On 10/5/2015 12:34 PM, Tim Dudgeon wrote:<br>
>><br>
>> That's a good point. Having to stop/start the server to generate an export is not ideal.<br>
>><br>
>> Tim <br>
>><br>
>> On 05/10/2015 11:56, Thomas Raehalme wrote:<br>
>>><br>
>>><br>
>>><br>
>>> On Mon, Oct 5, 2015 at 2:47 AM, Bill Burke <<a href="mailto:bburke@redhat.com">bburke@redhat.com</a>> wrote:<br>
>>>><br>
>>>> On 10/4/2015 5:37 PM, Thomas Raehalme wrote:<br>
>>>>><br>
>>>>><br>
>>>>> On Oct 4, 2015 23:57, "Bill Burke" <<a href="mailto:bburke@redhat.com">bburke@redhat.com</a><br>
>>>>> <mailto:<a href="mailto:bburke@redhat.com">bburke@redhat.com</a>>> wrote:<br>
>>>>> ><br>
>>>>> > For security reasons we did not want to have a remote option to export.<br>
>>>>><br>
>>><br>
>>> How about just storing the export as a local file on the server? You'd need access to the server in order to get the file (making the system compromised anyways). The change to current behaviour is that you would be able to trigger the export at will without server restart.<br>
>>><br>
>>> Best regards,<br>
>>> Thomas<br>
>>><br>
>>><br>
>>> _______________________________________________<br>
>>> keycloak-user mailing list<br>
>>> <a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
>>> <a href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
>><br>
>><br>
>><br>
>><br>
>> _______________________________________________<br>
>> keycloak-user mailing list<br>
>> <a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
>> <a href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
><br>
><br>
><br>
> _______________________________________________<br>
> keycloak-user mailing list<br>
> <a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
> <a href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
</p>