Do not empty attributes if they are not provided when user profile is enabled

Describe the bug

When the user declarative profile feature is enabled, attributes that are defined in the User Profile are always present in the user attributes even if they are not set (Admin Panel -> Users -> user -> attibutes tab).

Also, on an attempt to update a user through PUT endpoint attributes are removed from the user.

Context

We are using ABAC model and make use of the Keycloak user attributes extensively. To prevent users from accessing areas they should not have access to by modifying their attributes we enabled the Declarative User Profile feature and disabled write access to all the important attributes for the users leavin read access only (via Admin Panel -> Realm settings -> User Profile tab -> Attributes subtab -> attribute -> Permissions section -> Can user edit = FALSE, Can user view = TRUE). At the same time, administrators should have read and write access for those attributes (via Admin Panel -> Realm settings -> User Profile tab -> Attributes subtab -> attribute -> Permissions section -> Can admin edit = TRUE, Can admin view = TRUE). Attributes are not required in our case.

Problem 1

But when this is configured in this way, administrators can see attributes with empty values in the user attributes page (Admin Panel -> Users -> user -> Attributes tab) even if the attribute has not been set for the user. This is confusing for the administrators.

Problem 2

We make use of the Admin REST API to make some modifications on the users, for example, update email. But to make it happen it’s necessary to send the whole user representation with all the attributes otherwise they will be removed. This makes it necessary to do GET user request first to get full user representation modify it by updating email address and send PUT request to make an update. This introduces unneccessary HTTP call that could be avoided (and can be avoided in case Declarative User Profile feature is disabled)

Version

16.1.1

Expected behavior

1. Attributes that are not set for a user are not shown in the Admin Panel -> Users -> user -> Attributes tab
2. On a request to the PUT /auth/admin/realms/{realm}/users/{id} endpoint without attributes field in the request body all existing user attributes must preserve as it works when User Declarative Profile Feature is disabled.

Actual behavior

1. For users without attributes from the User Profile configuration fields are still shown on the user attributes tab in the Admin panel with an empty value
2. On a request to the PUT /auth/admin/realms/{realm}/users/{id} endpoint without attributes field in the request body all existing user attributes are removed when User Declarative Profile Feature is disabled.

How to Reproduce?

1. Enable Declarative User Profile feature https://www.keycloak.org/docs/latest/server_admin/index.html#enabling-the-user-profile
2. Create a user with username test, email [e-mail], and without any attributes
3. Go to Admin Panel -> Realm settings -> User Profile tab -> Attributes subtab -> click Create
4. Create a new attribute with the following parameters and click save: a. name: test-attribute b. Required: FALSE c. Permissions -> Can admin edit: TRUE d. Permissions -> Can admin view = TRUE e. Permissions -> Can user edit: FALSE f. Permissions -> Can user view = TRUE
5. Go to the user created on the Step 2 Admin Panel -> Users -> user with username test (from Step 2) -> Attributes tab a. test-attribute is shown with empty value even though it’s not set for the user. (Actual behavior 1)
6. Set user attribute test-attribute value to Test Value and save the user
7. Make a PUT request to the PUT /auth/admin/realms/{realm}/users/{id} endpoint to update user email for the user created on the step 2. Payload:

{
    "email": "[e-mail]"
}

1. Check user Admin Panel -> Users -> user with username test (from Step 2) a. User email has been updated to the [e-mail] (expected), however, b. on the User Attributes tab test-attribute value is empty (Actual behavior 2) even though it was not present in the PUT request. And this won’t happen in case Declarative User Profile feature is not enabled

Anything else?

No response

[daviddelannoy]

You’re right, I will make a new one, already prepared it in fact 😃 thanks

[ssilvert]

It was kinda on purpose because it helps administrators to look at the attributes available from the user profile.

But yeah, this topic is basically a UX discussion. Ideally, the UI should be built based on the user profile metadata.

Consider the following situation. You add an attribute and mark it as required. You don’t show it in the admin console (when empty). Now you try to save the user and you get an error message saying that the attribute is required.

By showing the empty attribute, the admin can just type the value.

We should probably involve @ssilvert in this discussion and see what works best for the new admin console.

Regarding the admin UI portion of this discussion, we are just starting on an advanced design. @agagancarczyk will do the implementation.

The way we plan to make it work is that any attribute defined as part of the user profile will not be displayed on the Attributes tab at all. Instead, the field will be rendered on the Details tab. This way, can use the definition of the attribute to improve the user experience. For instance, an attribute that only has three valid values will be displayed as a dropdown.

If Admin can edit is false, attribute will display as read only. If Admin can view is false, attribute will not be displayed.

For updates, I guess we will need to do the PATCH operation if you guys decide to implement it.

Also, I notice that attribute definitions should probably have a field for help text. And we should think about localization for both help text and display name.