# "Attempt to edit denied attribute" error on user registration with Active Directory federation

**URL:** <https://forum.keycloak.org/t/attempt-to-edit-denied-attribute-error-on-user-registration-with-active-directory-federation/18733>\
**Category:** Configuring the server\
**Tags:** user-federation\
**Created:** [December 1, 2022, 10:34am UTC](https://forum.keycloak.org/t/attempt-to-edit-denied-attribute-error-on-user-registration-with-active-directory-federation/18733 "2022-12-01T10:34:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![pellux-network](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/pellux-network/32/7117_2.png) [@pellux-network](https://forum.keycloak.org/u/pellux-network)\
**Post date:** [December 1, 2022, 10:34am UTC](https://forum.keycloak.org/t/attempt-to-edit-denied-attribute-error-on-user-registration-with-active-directory-federation/18733/1 "2022-12-01T10:34:09Z")

</div>

I’m currently trying to setup federation with my AD server and I’m getting an error I’m not sure how to fix.

```auto
2022-12-01 05:08:50,549 WARN [org.keycloak.userprofile.validator.ReadOnlyAttributeUnchangedValidator] (executor-thread-25) Attempt to edit denied attribute '(?i:^\QKERBEROS_PRINCIPAL\E$|^\QLDAP_ID\E$|^\QLDAP_ENTRY_DN\E$|^\QCREATED_TIMESTAMP\E$|^\QcreateTimestamp\E$|^\QmodifyTimestamp\E$|^\QuserCertificate\E$|^\Qsaml.persistent.name.id.for.\E.*$|^\QENABLED\E$|^\QEMAIL_VERIFIED\E$|^\QdisabledReason\E$)' of user 'testuser'
2022-12-01 05:08:50,549 WARN [org.keycloak.userprofile.validator.ReadOnlyAttributeUnchangedValidator] (executor-thread-25) Attempt to edit denied attribute '(?i:^\QKERBEROS_PRINCIPAL\E$|^\QLDAP_ID\E$|^\QLDAP_ENTRY_DN\E$|^\QCREATED_TIMESTAMP\E$|^\QcreateTimestamp\E$|^\QmodifyTimestamp\E$|^\QuserCertificate\E$|^\Qsaml.persistent.name.id.for.\E.*$|^\QENABLED\E$|^\QEMAIL_VERIFIED\E$|^\QdisabledReason\E$)' of user 'testuser'

```

Any advice on how to resolve this error would be greatly appreciated!

---

<div class="post-metadata">

**Author:** ![Jirvil](https://avatars.discourse-cdn.com/v4/letter/j/8e7dd6/32.png) [@Jirvil](https://forum.keycloak.org/u/Jirvil)\
**Post date:** [January 11, 2023, 11:17am UTC](https://forum.keycloak.org/t/attempt-to-edit-denied-attribute-error-on-user-registration-with-active-directory-federation/18733/2 "2023-01-11T11:17:09Z")

</div>

Hi!  
I’m following the same way and ran into the same problems. I was getting the same errors when a user opens an account console. I solved this error by setting Audience in Client Scopes - [here an example](https://stackoverflow.com/a/53627747).  
But immediately ran into another problem - _Error response 403: org.keycloak.services.ForbiddenException_.  
The next step I added default role “account manage-account” to all users in Realm Settings → User registration. Asign role - Filter by clients - “account manage-account”.

---

<div class="post-metadata">

**Author:** ![npetalid](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/npetalid/32/9358_2.png) [@npetalid](https://forum.keycloak.org/u/npetalid)\
**Post date:** [December 1, 2023, 9:53am UTC](https://forum.keycloak.org/t/attempt-to-edit-denied-attribute-error-on-user-registration-with-active-directory-federation/18733/3 "2023-12-01T09:53:11Z")

</div>

Hi,  
I am encountering a similar problem. I have my own custom User SPI (in case this is critical). I have assigned the scope and role as described. I still get the WARNING (even though the user is created).

Any ideas on how we can remove this warning?