<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">You can do this already though. You
need to setup like:<br>
- LDAP federation provider must have edit mode UNSYNCED<br>
- LDAP mapper for your attribute must have "readOnly" to "on" and
"alwaysReadValueFromLDAP" to "off". But this is default settings
for the mapper for UNSYNCED edit mode anyway, so you don't need to
explicitly configure anything in the mapper (you can just
doublecheck if mapper is really set like this)<br>
<br>
With setup like this, the attribute of user is read from LDAP
during initial import of user from LDAP. But when you change
attribute to some other value, the value is updated just to
Keycloak DB (not to LDAP). And for all next reads of user,
keycloak will see the value from the DB (not the one from LDAP).<br>
<br>
Also you can add any new attribute to the user too. This will be
always saved to Keycloak DB and never to LDAP.<br>
<br>
Marek<br>
<br>
On 27/02/16 01:07, Bill Burke wrote:<br>
</div>
<blockquote cite="mid:56D0E8AE.7090605@redhat.com" type="cite">
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
You have to code it yourself. Not sure if our ldap adapter is
documented to do that or not.<br>
<br>
<div class="moz-cite-prefix">On 2/26/2016 7:03 PM, Jason Axley
wrote:<br>
</div>
<blockquote
cite="mid:E9B6789B-6D4A-4CD4-B4A9-4E9251411AE9@expedia.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<div>
<div>
<div>Some Idm products provide a virtual-directory-like
capability where you can manage derived attributes for
users regardless of the origin data store. I could see it
be advantageous to be able to layer metadata or other
derived data on identities to make things easier to
consume in downstream systems. Would that be feasible in
Keycloak?</div>
<div><br>
</div>
<div>-Jason</div>
<div> </div>
</div>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:12pt;
text-align:left; color:black; BORDER-BOTTOM: medium none;
BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT:
0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid;
BORDER-RIGHT: medium none; PADDING-TOP: 3pt"> <span
style="font-weight:bold">From: </span><<a
moz-do-not-send="true" class="moz-txt-link-abbreviated"
href="mailto:keycloak-user-bounces@lists.jboss.org"><a class="moz-txt-link-abbreviated" href="mailto:keycloak-user-bounces@lists.jboss.org">keycloak-user-bounces@lists.jboss.org</a></a>>
on behalf of Bill Burke <<a moz-do-not-send="true"
href="mailto:bburke@redhat.com">bburke@redhat.com</a>><br>
<span style="font-weight:bold">Date: </span>Friday,
February 26, 2016 at 1:00 PM<br>
<span style="font-weight:bold">To: </span>"<a
moz-do-not-send="true" class="moz-txt-link-abbreviated"
href="mailto:keycloak-user@lists.jboss.org"><a class="moz-txt-link-abbreviated" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a></a>"
<<a moz-do-not-send="true"
href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>><br>
<span style="font-weight:bold">Subject: </span>Re:
[keycloak-user] user Attribute error<br>
</div>
<div><br>
</div>
<div>
<div bgcolor="#FFFFFF" text="#000000">Why do you expect to
be able to add an attribute on a read-only LDAP? I'm
confused...<br>
<br>
<div class="moz-cite-prefix">On 2/26/2016 11:03 AM, Gerard
Laissard wrote:<br>
</div>
<blockquote
cite="mid:4AC8C602867B3A4CB6F9F6BA4528DEE477B45E2F@WPHXMAIL1.phx.axway.int"
type="cite">
<meta name="Generator" content="Microsoft Word 14
(filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span lang="FR">Hi,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="FR"><o:p> </o:p></span></p>
<p class="MsoNormal">I’m using user Federation LDAP.
The LDAP is read-only.<o:p></o:p></p>
<p class="MsoNormal">When I add a user Attribute, I
get ‘Error! user is read-only!’<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">How can I add specific user
attributes? <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks<o:p></o:p></p>
<p class="MsoNormal">Gerard<o:p></o:p></p>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
keycloak-user mailing list
<a moz-do-not-send="true" class="moz-txt-link-abbreviated" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a></pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Bill Burke
JBoss, a division of Red Hat
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://bill.burkecentral.com">http://bill.burkecentral.com</a></pre>
</div>
</div>
</span> </blockquote>
<br>
<pre class="moz-signature" cols="72">--
Bill Burke
JBoss, a division of Red Hat
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://bill.burkecentral.com">http://bill.burkecentral.com</a></pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
keycloak-user mailing list
<a class="moz-txt-link-abbreviated" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>
<a class="moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a></pre>
</blockquote>
<br>
</body>
</html>