Keycloak Identity Provider – Avoid Creating Local Users

Getting advice
1

Hello everyone,

I have a Keycloak deployment where I’ve configured an external Identity Provider (IdP) for authentication. I’m trying to achieve the following flow:

  • A user logs in via the external IdP
  • An IdP mapper is used to assign appropriate roles
  • The user is not created or stored locally in the Keycloak user database

Is there a supported way to prevent Keycloak from creating a local user entry when authenticating through the IdP? Ideally, I’d like to rely entirely on the IdP for user identity and avoid any local persistence.

Any guidance or best practices would be greatly appreciated!

Many thanks!

2

No, there isn’t. Keycloak needs a local instance for being able to work properly.

1 Like
3

Thank you for the response.

4

Couldn’t this be managed with transient users?

5

The transient users feature is experimental, not supported and subject to be removed again in future.

1 Like
6

I’ve seen others solve this by automating a recurring task that deletes users that have no active sessions.

7

See Issue #39888 for the future behaviour