@ssilvert if you are replying to a comment you can use the 'Write a reply' text box, otherwise you'll start a new thread like this one.

You should be able to do this with fine-grained permissions. If you discover that fine-grained has a bug or missing functionality for your use case then open an issue.

That being said, we do want to make it easy to remove and replace sections as mentioned in the requirements above. So what you propose would indeed be another approach in the future. But if fine-grained can do the job then I suggest you go with that instead because you wouldn't have a code base of your own to maintain.

How can i restrict an user to create clients without the right to manage all clients - based on the fine-grained permissions?

@braunpa That's way outside the scope of this discussion. I suggest you start a new one or use the keycloak-users mailing list.

@Shuyinsama so you want a 3rd way to add attributes to users? How would this differ from when you don't have user profile enabled?

So what we used to do was that we've altered the create user and edit user views of the admin theme.

In those forms we added new fields with specific options and or validations. These fields were then saved as a "Attribute" in the "Attributes" tab section of a user.

Next to that we disabled the "Attributes" tab for out clients so they could only alter those attributes throught the edit form.

Our clients could only create or save a user if those fields were set. That way our code would not fail when getting these Key/value pairs

At the moment these tabs are back and the form doesnt have our custom fields anymore making it possible for our clients to create/edit a user without those attributes resulting in errors in our application.

So I don't necessarily want a 3rd way but a good way to be able to alter the create/edit forms of the theme without having the "User Profiles" feature enabled. Unless "User Profiles" is gonna be the default and the templates would work like this anyway

User Profile will definitely be the default and preferred way to manage user attributes going forward.

How we allow other forms to be altered/added/removed is still under consideration.