Search code examples
keycloakkeycloak-rest-api

How to set user attribute value in Keycloak using API?

How I can set user attribute value using Keycloak Rest API?

enter image description here

Solution

  • Update: The /auth path was removed starting with Keycloak 17 Quarkus distribution. So you might need to remove the /auth from the endpoint calls presented on this answer.

    To set a user attribute using the Keycloak Admin REST API; you use the endpoint:

    PUT <KEYCLOAK_HOST>/auth/admin/realms/<YOUR_REALM>/users/<USER_ID>

    with the payload

    {"attributes":{"<ATTRIBUTE_NAME>":["<ATTRIBUTE_VALUE>"]}}

    the <USER_ID> you can get it using the endpoint:

    GET <YOUR_KEYCLOAK_DOMAIN>/auth/admin/realms/<YOUR_REALM>/users/?username=<THE_USERNAME>

    from the JSON response, extract the field id.

    Step-by-Step:

    You can get that information using the Keycloak Admin REST API; to call that API, you need an access token from a user with the proper permissions. For now, I will be using the admin user from the master realm:

    curl https://${KEYCLOAK_HOST}/auth/realms/master/protocol/openid-connect/token \
    -d "client_id=admin-cli" \
    -d "username=$ADMIN_NAME" \
    -d "password=$ADMIN_PASSWORD" \
    -d "grant_type=password"

    You will get a JSON response with the admin's token. Extract the value of property access_token from that response. Let us save it in the variable $ACCESS_TOKEN for later reference.

    To get the user id from your realm $REALM_NAME:

    curl -X GET https://${KEYCLOAK_HOST}/auth/admin/realms/${REALM_NAME}/users/?username=${USERNAME}&exact=true \
     -H "Content-Type: application/json" \
     -H "Authorization: bearer $ACCESS_TOKEN"

    From the response extract the user id for example as follows

    jq -r .[].id

    Or even cleaner is to passed to the

    To set the user attribute:

    curl -X PUT https://${KEYCLOAK_HOST}/auth/admin/realms/${REALM_NAME}/users/${USER_ID} \
     -H "Content-Type: application/json" \
     -H "Authorization: bearer $ACCESS_TOKEN" \
     -d '{"attributes":{"<ATTRIBUTE_NAME>":["<ATTRIBUTE_VALUE>"]}}'

    You can also have a look at setUser script on my GitHub repo.