keycloak

Preventing user from modifying their name in Keycloak

In Keycloak, by default, users are able to change their first and last name in the account manager page. However, is it possible to disable this behavior?

Removing both fields in the theme results in those values not being sent and the form failing, and a hand-crafted POST request would defeat this method anyway.

Solution

  • In Keycloak, by default, users are able to change their first and last name in the account manager page. Is it possible to disable this behavior?

    That can be done out-of-the-box (since Keycloak 14) by using the user profile functionality. First, the preview feature declarative-user-profile has to be enabled. For that start the server with:

    --features=declarative-user-profile.

    for the Quarkus version, or with

    -Dkeycloak.profile.feature.declarative_user_profile=enabled

    for the Wildfly version.

    Bear in mind that:

    Declarative User Profile is Technology Preview and is not fully supported.

    After starting the server with the aforementioned option, go to the Keycloak Admin Console and:

    enter image description here

    A new tab named User Profile (top right) will show up; click on it, and a set of configurable attributes will be shown.

    enter image description here

    Click on firstName, and then go to Permissions

    enter image description here

    In that section the permissions can be changed, accordingly. For example, if one sets Can user edit? to OFF, then when the user tries to change the firstName field in the account UI, that UI throws the following warning message:

    The field First name is read only.

    The same configuration can also be applied to the lastName attribute.

    For the new Keycloak UI the workflow is exactly the same as the one I have just described. More information about the feature can be found in the official keycloak documentation (link)

    UPDATE:

    For new keycloak versions use the following env var:

    - name: KC_FEATURES
  value: 'declarative-user-profile'