Search code examples
javasingle-sign-onkeycloak

Extending default Keycloak Account management

I'm trying to extend the default Account interface in order to comply with GDPR, meaning I'd like to enable a user to delete their own profile.

The way I thought I'd go about it is by creating an endpoint eg.: http://keycloak/auth/realms/my-realm/account/delete

However the documentation is really unclear on what I should be doing.

I managed to get a custom REST endpoint working, but I'm trying to make this accessible in a browser only, without any auth tokens.

My second idea was to create a custom SPI, but once again the documentation fails to explain in detail how you would go about this. I'm not even certain at all that what I need is an SPI.

Basically what I want to achieve is this:

  1. User visits their account
  2. Clicks "Delete Profile" button
  3. Custom endpoint catches request, logs out then deletes user
  4. User gets redirected to login page

Any ideas on how to implement this? I'm willing to use existing solutions as well if any exists.

Solution

  • Account deletion is available as scince KEYCLOAK-953.

    See Enabling account deletion by users.

    Note that it's also possible to adding custom attributes.