UI Customization - Proposed Requirements

[ssilvert]

There have been several discussions about providing easier customization of our UI offerings. This is especially true of the new Admin and Account consoles. I want to put forth proposed requirements and get some feedback. I'd like to know what is most important to the community. Feel free to share any thoughts and ideas.

Goal

The overall goal for customization of Keycloak Admin Console and Keycloak Account Console is that both should be more easily and comprehensively customizable than the old Angular/Freemarker versions.

Requirements List

• A user who only wants to change the look and feel of the UI should be able to do so without writing any code except CSS.
• It should be possible to deploy a shared CSS file for both admin and account console.
• Developers should have an environment that is as good as or better than what we use on the UI team.
• We will provide quickstarts that help developers get up and running fast.
• Quickstarts should demonstrate all customization features.
• Quickstarts will provide the ability to create a deployable jar for themes. (Create production-ready themes)
• Utilize guides section of Keycloak web site (keycloak.org/guides)
• Deployable jar should not contain Keycloak console code.
• A developer should be able to create new versions of the consoles that will continue to work (at least) between minor releases.
• It should be easy to add and remove sections (i.e. lefthand navigation items).
• It should be easy to call both built-in and custom REST endpoints from an extension.
• Developers should have easy access to shared services/hooks such as those for localization/whoami/etc.
• Framework agnostic

[danielFesenmeyer]

Sounds great.
I think it would also be great to customize the the navigation items: if theme developers could select which keycloak builtin items are displayed, and more importantly, could add their own.

[ssilvert]

Sounds great. I think it would also be great to customize the the navigation items: if theme developers could select which keycloak builtin items are displayed, and more importantly, could add their own.

That was the intent. That's what we call "sections". I'll make that more explicit in the requirements.

[jonkoops]

@ssilvert if you are replying to a comment you can use the 'Write a reply' text box, otherwise you'll start a new thread like this one.

[braunpa]

One question from my side. I want to have a fine granted permissions for the admin console. For example a Realm-Admin-User should have only this permissions:

• manage only the clients from her/his team
• can create new clients
• can add roles from defined clients
  I was using the fine granted admin permission feature but its still a "Preview Feature" and in some cases a bit buggy - is there any simple way to extend keycloak to fulfil the requirements for this "little" self-service portal? Or What is the proper way to do it - besides of the preview feature "admin-fine-grained-authz" and forking and maintaining the complete mono repo just for the adminUI?

[ssilvert]

You should be able to do this with fine-grained permissions. If you discover that fine-grained has a bug or missing functionality for your use case then open an issue.

[ssilvert]

That being said, we do want to make it easy to remove and replace sections as mentioned in the requirements above. So what you propose would indeed be another approach in the future. But if fine-grained can do the job then I suggest you go with that instead because you wouldn't have a code base of your own to maintain.

[braunpa]

How can i restrict an user to create clients without the right to manage all clients - based on the fine-grained permissions?

[ssilvert]

@braunpa That's way outside the scope of this discussion. I suggest you start a new one or use the keycloak-users mailing list.

[Shuyinsama]

Thank you for providing this update and a separate discussion. Though I must admit I'm sad to see the state this problem is still in and I feel this hasn't moved forward at all since the removal of the themability of the admin/account consoles.

Nevertheless I am happy to see this thread being made and hope to see some progress. I am also willing to help with any development on this issue.

As for the adding some points:

• As a developer I am able to implement the setting of custom "attributes" through the "Create" and "Edit User" views without the user having to add these custom attributes themselves.
  • I am also aware of the development of the "declarative-user-profiles" and "account3" features which might add this option to the base keycloak theme. But I would love to see a way for developers to extend and expand on this declarative style

[edewit]

@Shuyinsama so you want a 3rd way to add attributes to users? How would this differ from when you don't have user profile enabled?

[Shuyinsama]

So what we used to do was that we've altered the create user and edit user views of the admin theme.

In those forms we added new fields with specific options and or validations. These fields were then saved as a "Attribute" in the "Attributes" tab section of a user.

Next to that we disabled the "Attributes" tab for out clients so they could only alter those attributes throught the edit form.

Our clients could only create or save a user if those fields were set. That way our code would not fail when getting these Key/value pairs

At the moment these tabs are back and the form doesnt have our custom fields anymore making it possible for our clients to create/edit a user without those attributes resulting in errors in our application.

So I don't necessarily want a 3rd way but a good way to be able to alter the create/edit forms of the theme without having the "User Profiles" feature enabled. Unless "User Profiles" is gonna be the default and the templates would work like this anyway

[ssilvert]

User Profile will definitely be the default and preferred way to manage user attributes going forward.

How we allow other forms to be altered/added/removed is still under consideration.