49 lines
2.7 KiB
Markdown
49 lines
2.7 KiB
Markdown
# Attribute Endpoints Provider - Export User Attributes
|
|
|
|
This is a Keycloak Provider that exports user profile attribute values.
|
|
The selection of attributes and authorization is manage through an endpoint configuration.
|
|
|
|
## Usage
|
|
|
|
The provider adds an object type "Attribute Endpoints" to the Keycloak admin website.
|
|
You configure the provider by creating one or more endpoint configurations.
|
|
|
|
Each endpoint configuration requires:
|
|
- a name that is the reference in the endpoint URL (slug)
|
|
- the name of a role that the calling user must have to be allowed to query this endpoint
|
|
- the name of an attribute or an attribute group that should be exported
|
|
- the name of a role that users must have to be included in the list
|
|
- an optional regular expression that must match to have a value included
|
|
|
|
> **Note** The attribute (group) and the roles need to exist before you can create the endpoint configuration.
|
|
|
|
There are two endpoints returning JSON:
|
|
- `export/slug`: collate all attribute values into a single list
|
|
- `export/slug/map`: produce a map of lists, with the key being the attribute name
|
|
|
|
No other data is included in the response, in particular, there is no information on which attribute value is associated with which user.
|
|
|
|
User Attribute values can be single or multi-value; the resulting list will include them as a flattened list.
|
|
|
|
> **⚠️ Note** The authorization and the selection of the user attributes are not tied together in any way.
|
|
> Every user that has the matching role will have all the attributes included that are specified in the endpoint configuration.
|
|
> In other words, if you are exporting an attribute group, all attributes will be included.
|
|
|
|
> **⚠️ Note** Keycloak has no concept of authorization for individual user attributes (for example, based on assigned roles).
|
|
> Users will be able to see and edit any attribute that has been made available to users, irrespective of whether a user would
|
|
> be included in an endpoint configuration export or not.
|
|
|
|
|
|
## Building
|
|
|
|
Maven is required for building the provider.
|
|
|
|
Once all dependencies are met, simply call `make` to build the provider, which should then produce a `attribute-endpoints-provider-1.0-SNAPSHOT.jar` in the `attribute-endpoints-provider/target/` directory.
|
|
|
|
There's also `make clean` available for removing the output directory.
|
|
|
|
To add the provider to your Keycloak install, copy `attribute-endpoints-provider/target/attribute-endpoints-provider-1.0-SNAPSHOT.jar` to the Keycloak Provider directory (`/opt/keycloak/providers/`).
|
|
|
|
## Testing Setup
|
|
|
|
See [testing/README.md](testing/README.md) for details on the Docker Compose based setup that includes a realm and the ability to attach a debugger to the running Keycloak.
|