One-time all-users import from external (legacy) user storage via Keycloak UI.

[konstantin-krasheninnikov-ullink]

Is it possible to implement UserSorageProvider tailored for a one-time migration of all the users from a legacy user storage to the Keycloak storage via Keycloak UI in a way that would also add certain actions to all the imported users (e.g. update/set password)?

This way it would be really easy to migrated users:

• implement legacy user storage provider;
• login to Keycloak UI;
• configure the legacy provider;
• import all the users. All users are now migrated. Hooray!
• remove the legacy provider;
• when legacy users try logging in, Keycloak asks them to set their passwords.

Question: what interfaces to implement and how to adapt legacy user to Keycloak's UserModel?

One would think that's the easiest way to migrate users from a proprietary legacy OIDC provider. Unfortunately, I could not find any clear recipe/example for it.

Documentation suggests using import strategy, but one-by-one, which requires keeping legacy storage connected until all the users migrate (long time if not forever).

My thinking is that I would need to do the following:

• Implement UserQueryProvider (because "You must implement this interface if you want to view and manage users from the administration console.")
• Use custom UserModel implementation where "get" methods return legacy users information (I assume Keycloak will use said get-methods to get user info to persist).

Anything else? Hopefully I do not need to implement ImportSynchronization interface because this is one-time import of all the legacy users. Or... will the Keycloak UI use that to do one-time import? Not sure.

I would appreciate your input. Thanks.