Thanks for the hints. I am most interested in ClaimToRoleMapper for oidc. I created a ClaimToRole mapper and did some testing. Sounds like when I remove a role from a user, the user role list is updated correctly. When I add a role to a user, the user role list did not update. I ended up with looking at the updateBrokeredUser() in ClaimToRoleMapper, if I read the code correctly, it seems that we have handled the user role deletion case but not user role addition case. Wonder if we can enhance the code support both cases assuming I read the code correctly.
@Override
public void updateBrokeredUser(KeycloakSession session, RealmModel realm, UserModel user, IdentityProviderMapperModel mapperModel, BrokeredIdentityContext context) {
String roleName = mapperModel.getConfig().get(HardcodedRoleMapper.ROLE);
if (!hasClaimValue(mapperModel, context)) {
RoleModel role = HardcodedRoleMapper.getRoleFromString(realm, roleName);
if (role == null) throw new IdentityBrokerException("Unable to find role: " + roleName);
user.deleteRoleMapping(role);
}
}
Yes, you have to configure the appropirate mapper in the "mappers" tab in admin console. The method IdentityProviderMapper.updateBrokeredUser() is called after each successful login of user with the identity provider.
I think you can choose one of predefined mapper implementation for update the attribute from identity provider. I think we have the implementations for both OIDC and SAML providers. In worst case, you can create your own implementation of IdentityProviderMapper to do exactly what you want. This would be still much better than delete/create user during each login.
Marek
On 21/04/16 20:36, Xiao Ma wrote:
Hi,
I have a custom user attribute (telephone number) for the users in my identity provider. When this user attribute for a given user is updated in my identity provider,, the corresponding user attribute for that user in the keycloak database doesn't update automatically.
I have to delete the user from keycloak database and force a user recreation in the next new user login (using First Broker Login Authentication Flow), then my updated customer attribute will show up. Is there a way to update user attribute automatically without a user recreation?
Thanks a lot,
Xiao
_______________________________________________ keycloak-user mailing list keycloak-user@lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user