Current Behavior
Importing a realm export that was taken from a different Keycloak instance fails with HTTP 403 on the roles Keycloak protects (admin, create-realm, and the realm-management client roles).
RoleImportService only issues an update when the imported role differs from the existing one, but that comparison includes the server-generated id and containerId. Those UUIDs are unique per Keycloak instance, so in a cross-instance export every role compares as changed and an update is sent for all of them — including roles that were never actually modified.
Since Keycloak #49624 (keycloak/keycloak#49624) (26.6.4) those roles reject updates, so the import now aborts. Before 26.6.4 the same spurious updates were silently accepted and only caused unnecessary write traffic.
Note ClientImportService already excludes id from its comparison, which is why the realm-management client imports without error while its roles do not.
Expected Behavior
Server-generated identifiers should not be treated as a change. A realm export imported into a fresh instance should be a no-op for roles that are semantically identical, and protected roles should not receive an update request unless something meaningful actually differs.
Steps To Reproduce
1. Keycloak instance A: export a realm (full export, includes roles with their id/containerId).
2. Keycloak instance B (26.6.4+, a different instance so UUIDs differ): create the same realm.
3. Run keycloak-config-cli against instance B with the export from step 1.
4. Import fails with HTTP 403 when updating admin / create-realm / a realm-management client role.
Re-importing the same export into the same instance does not reproduce it — the identifiers match, so no update is sent.
Deployment Method
Docker
Environment
- Keycloak Version: 26.7.3 and 26.3.3
- keycloak-config-cli Version: latest
- Java Version: 21 (or whatever is in the container)
Relevant configuration (sanitized)
Logs / error output
Anything else?
I am willing to create a PR for this.
No response
Current Behavior
Importing a realm export that was taken from a different Keycloak instance fails with HTTP 403 on the roles Keycloak protects (
admin,create-realm, and therealm-managementclient roles).RoleImportServiceonly issues an update when the imported role differs from the existing one, but that comparison includes the server-generatedidandcontainerId. Those UUIDs are unique per Keycloak instance, so in a cross-instance export every role compares as changed and an update is sent for all of them — including roles that were never actually modified.Since Keycloak #49624 (keycloak/keycloak#49624) (26.6.4) those roles reject updates, so the import now aborts. Before 26.6.4 the same spurious updates were silently accepted and only caused unnecessary write traffic.
Note
ClientImportServicealready excludesidfrom its comparison, which is why therealm-managementclient imports without error while its roles do not.Expected Behavior
Server-generated identifiers should not be treated as a change. A realm export imported into a fresh instance should be a no-op for roles that are semantically identical, and protected roles should not receive an update request unless something meaningful actually differs.
Steps To Reproduce
Deployment Method
Docker
Environment
Relevant configuration (sanitized)
Logs / error output
Anything else?
I am willing to create a PR for this.
No response