keycloak_user attributes not applied on first terraform apply, no error shown

[rif281]

Describe the bug

Description

When creating a user with the keycloak_user resource and setting attributes, they appear in the first terraform plan output, but are not created in Keycloak after the first apply. No error is shown. Running plan and apply a second time applies the missing attributes successfully.

Terraform Configuration

resource "keycloak_user" "user" {
  for_each = local.keycloak_spec["keycloak_users"]
  realm_id = keycloak_realm.name.id
  username = each.key
  enabled  = local.enable_local_users

  email          = lookup(each.value , "email", "${each.key}@${each.key}.com")
  email_verified = lookup(each.value , "email_verified", false)
  first_name     = lookup(each.value , "first_name", each.key)
  last_name      = lookup(each.value , "last_name", each.key)

  attributes = {
    role        = each.value["role"]
    phoneNumber = lookup(each.value , "phoneNumber", "0000000000")
  }

  initial_password {
    value     = random_password.keycloak_users_secrets[each.key].result
    temporary = false
  }
}

First plan output:

# module.keycloak_seed.keycloak_user.user["user1"] will be created
+ attributes = {
    "phoneNumber" = "0000000000"
    "role"        = "AccountAdmin"
  }
+ other fields...

Second plan output:

# module.keycloak_seed.keycloak_user.user["user1"] will be updated in-place
! attributes = {
    "phoneNumber" = "0000000000"
    "role"        = "AccountAdmin"
  }

Version

24.0.4

Expected behavior

The attributes should be created after the first apply, or an error message should be displayed.

Actual behavior

No error message is displayed, and the attributes are only created after the second attempt.

How to Reproduce?

No response

Anything else?

No response

[bakarJc]

TLDR; It should work if in the keycloak_user resource you add:

depends_on = [keycloak_realm_user_profile.your_user_profile]

Why?

The terraform provider does send the custom attributes when applying for the first time. you can verify this by setting:
export TF_LOG=trace

In the logs then you should see a POST call to /admin/realms/{realm}/users WITH the attributes.

The problem is, if you're creating a resource "keycloak_realm_user_profile" with these custom attributes, also via terraform, that profile might not yet be fully available and keycloak just drops the extra attributes.

On the second apply, the profile is available and it works.

[rif281]

TLDR; It should work if in the keycloak_user resource you add:

depends_on = [keycloak_realm_user_profile.your_user_profile]

Why?

The terraform provider does send the custom attributes when applying for the first time. you can verify this by setting: export TF_LOG=trace

In the logs then you should see a POST call to /admin/realms/{realm}/users WITH the attributes.

The problem is, if you're creating a resource "keycloak_realm_user_profile" with these custom attributes, also via terraform, that profile might not yet be fully available and keycloak just drops the extra attributes.

On the second apply, the profile is available and it works.

It worked for me, thank you very much!