Keycloak Registration

Keycloak Registration is a companion module to Keycloak User Sync. It fills three gaps that Keycloak User Sync cannot cover through its own configuration, so that a user created in Drupal is fully provisioned in Keycloak — with their real name, their group memberships, and the account-setup email that actually lets them log in.

The two modules are designed to work together: Keycloak User Sync creates, updates, and deletes the Keycloak user and its flat attributes; Keycloak Registration layers the remaining provisioning on top.

Features

• First/last name sync — reads a compound Name field (its given/family columns) from a configurable source entity (e.g. a Profile, or the user itself) and pushes it to Keycloak firstName/lastName. Keycloak User Sync can only map flat field values.
• Group membership sync — maps a user field holding Keycloak group names to the user's top-level Keycloak group memberships (nested group trees are searched). Optionally removes memberships not present in the field, or leaves groups managed directly in Keycloak untouched.
• Account-setup ("welcome") email — triggers Keycloak's execute-actions-email, so a newly created user actually receives the "set password / verify email" message. Keycloak User Sync only sets required actions; it never asks Keycloak to send the email. Sent exactly once per user, with a configurable minimum delay and cron-based retries.
• Locale sync — sets the Keycloak user's locale from the Drupal account language, so the email and its action link render in the user's language.

Requirements

• Keycloak User Sync, installed and configured (this module reuses its connection and service-account credentials from settings.php).
• The Keycloak service-account client needs the realm-management roles manage-users, view-users, query-users, and query-groups.
• Keycloak realm SMTP must be configured to deliver the account-setup email.
• Optional: the Name module for the first/last name sync feature.

Installation

1. Install as you would normally install a contributed Drupal module: composer require drupal/keycloak_registration.
2. Enable the module. It sets its own module weight to 10 so its hooks run after Keycloak User Sync's — the Keycloak user must already exist when this module looks it up.

Configuration

Configure the module at Administration » People » Keycloak Registration (/admin/people/keycloak-registration): enable the account-setup email and the group/name sync features, and point them at your field machine names. The Keycloak connection itself comes from Keycloak User Sync's settings:

$settings['keycloak_user_sync.connection'] = [
  'url'   => 'https://keycloak.example.com',
  'realm' => 'your-realm',
];
$settings['keycloak_user_sync.credentials'] = [
  'client_id'     => 'drupal-sync',
  'client_secret' => '…',
];

Use cases

• Editorial or HR workflows where accounts are created in Drupal and users must receive a Keycloak "set your password / verify your email" message automatically.
• Sites storing structured names in a compound Name field (e.g. on a Profile) that should appear as first/last name in Keycloak and downstream SSO clients.
• Managing Keycloak group memberships from Drupal user data — additively, or authoritatively with removal of unmanaged memberships.