Add support for partial update of users

[jirutka]

Problem Statement

I’m using User Federation (LDAP), so I don’t wanna update the user name, email etc., but I’d like to manage realm roles and client roles via keycloak-config-cli.

Proposed Solution

Make IGNORED_PROPERTIES_FOR_UPDATE configurable via CLI option. Or better, add an inverse option to specify the properties that should be updated.

Environment

No response

Additional information

No response

Acceptance Criteria

No response

[jonasvoelcker]

Hi @jirutka, I guess this would not be that easy because keycloak only has a PUT-route for users so you need to load every detail of that user to make changes about them. If there is some interaction and the user changes an attribute, that information would be lost afterwards.

[Motouom]

Problem Statement

I’m using User Federation (LDAP), so I don’t wanna update the user name, email etc., but I’d like to manage realm roles and client roles via keycloak-config-cli.

Proposed Solution

Make IGNORED_PROPERTIES_FOR_UPDATE configurable via CLI option. Or better, add an inverse option to specify the properties that should be updated.

Environment

No response

Additional information

No response

Acceptance Criteria

No response

Hi @jirutka, in light of @jonasvoelcker's observation, it appears that there may be an issue with modifying realm and client roles without loading the complete configuration for kccli to accurately identify those properties. Have you come across a workaround for this?

[Motouom]

Hi @jirutka

Are you still interested in this feature? As keycloak does not offer PATCH, we might think of loading the user, modifying the user, and using PUT to upgrade the user.

[jirutka]

Yes, I’m still interested.