Our customers wants to have a system, where they can define individual users to be either local or federated (LDAP). However, they don’t want this selection to be permanent, instead they want to be able to turn local users into LDAP users and convert back to local if they want. This seems to be tricky to implement using the provided LDAP support, but perhaps I have missed something. Therefore I decided to ask for help.
We have a custom user management application which communicates with Keycloak using the provided Java API. I have seen that there is unlinkUsers(RealmModel, String) in UserProvider interface, but this is a batch operation unlinking all federated users from some defined federation provider. Is it really so that we cannot do this for an individual user? The administration GUI implies as well that this is not possible for individual users.
If not, is there any alternative means for toggling the federation link off or on for an individual user using the Java API?