Brute Force Detection is disabled when updating frontenUrl via admin client

[jojo-schneider]

Before reporting an issue

• I have searched existing issues
• I have reproduced the issue with the latest release

Area

admin/client/node

Describe the bug

When the frontenUrl is updated through the admin client e.g.:

 await this.client.realms.update(
        {realm},
        {
          attributes: {
            frontendUrl: `${frontendUrl}/auth`,
          },
        },
      );

the brute force detection mechanism is unexpectedly disabled.

Version

21.1.1

Expected behavior

Changing the frontenUrl attribute should not affect brute force settings

Actual behavior

Brute force detection is disabled when changing frontenUrl

How to Reproduce?

1. Enable brute force detection for a realm using the Keycloak admin UI.
2. Set a new frontendUrl for this realm using the Keycloak admin client.
3. Inspect the brute force settings for this realm using the Keycloak admin UI.

Anything else?

Same behaviour with security header settings. They are also deleted when the frontendUrl is updated. Seems to affect all security defence settings of the realm