Wildcard search not working for custom user attributes

[ssilvert]

Before reporting an issue

• [X] I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

admin/ui

Describe the bug

When doing an attribute search for users, the built-in attributes (username, email, firstName, lastName) will do a wildcard search. For instance, if you search for a firstName with Jo it will return users named John, Joseph, Joan, etc.

But if you search for a custom attribute it only searches on an exact match.

We should at least do a wildcard search on both. Or better yet, allow the user to choose the type of search.

Version

nightly

Regression

• [ ] The issue is a regression

Expected behavior

Wildcard search for custom attributes.

Actual behavior

Exact match.

How to Reproduce?

See description.

Anything else?

No response

[ssilvert]

I'm reassigning to the core-iam team. Request that the search for user profile attributes behave the same as for the built-in attributes. That is, don't do an exact match search.

[keycloak-github-bot[bot]]

Due to the amount of issues reported by the community we are not able to prioritise resolving this issue at the moment.

If you are affected by this issue, upvote it by adding a :thumbsup: to the description. We would also welcome a contribution to fix the issue.

[sguilhen]

That would only be possible for attributes whose value doesn't exceed 255 characters - for performance reasons, attributes longer than that have a corresponding hash column, and the value is compared to the respective hash, making it not possible to do any kind of wildcard searches.

For attributes shorter than 255 character it would be possible to adjust the provider to allow for wildcard searches.

[RomekCDPR]

Hi. https://github.com/keycloak/keycloak/pull/34133 caused outage on our production instance of Keycloak. We searched for users by attribute assuming exact search, and after updating to 26 saturated our DB. Can we please introduce such changes maintaining backward compatibility (i.e. default exact=true) and list them in the changelog?

[pedroigor]

@RomekCDPR We are fixing the regression here https://github.com/keycloak/keycloak/pull/35823. Thanks for the heads up.