keycloak · pedroigor · Aug 11, 2026 · Aug 9, 2026
@@ -16,6 +16,7 @@
 import org.keycloak.scim.resource.common.MultiValuedAttribute;
 import org.keycloak.scim.resource.schema.attribute.Attribute;
 import org.keycloak.scim.resource.schema.path.Path;
+import org.keycloak.scim.resource.spi.ScimMutabilityException;
 import org.keycloak.util.JsonSerialization;
 
 import com.fasterxml.jackson.databind.JsonNode;
@@ -353,6 +354,17 @@ private void setValue(M model, Attribute<M, R> attribute, Object value, Operatio
         Objects.requireNonNull(attribute, "attribute cannot be null");
         Objects.requireNonNull(operation, "operation cannot be null");
 
+        if (attribute.isImmutable() && operation != SET) {
+            String modelAttrName = attribute.getModelAttributeName();
+            if (modelAttrName == null || getAttributeValue(model, modelAttrName) != null) {
+                throw new ScimMutabilityException(
+                        "Attribute '" + attribute.getName() + "' is immutable");
+            }
+            if (operation == REMOVE) {
+                return;
+            }
+        }
+
         JsonNode jsonValue = toJsonNode(value);
 
         switch (operation) {

@@ -0,0 +1,28 @@
+/*
+ * Copyright 2026 Red Hat, Inc. and/or its affiliates
+ * and other contributors as indicated by the @author tags.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.keycloak.scim.resource.spi;
+
+/**
+ * Exception thrown when a PATCH operation targets an immutable attribute.
+ */
+public class ScimMutabilityException extends RuntimeException {
+
+    public ScimMutabilityException(String message) {
+        super(message);
+    }
+}
@@ -75,6 +75,7 @@ protected Object getAttributeValue(GroupModel model, String name) {
 
                 yield members.toList();
             }
+            case "createdTimestamp" -> model.getCreatedTimestamp();
             default -> null;
         };
     }

@@ -79,6 +79,9 @@ protected Object getAttributeValue(UserModel model, String name) {
         if (UserModel.EMAIL.equals(name)) {
             return model.getEmail() == null ? List.of() : List.of(model.getEmail());
         }
+        if (UserModel.CREATED_TIMESTAMP.equals(name)) {
+            return model.getCreatedTimestamp();
+        }
         UserProfile profile = session.getProvider(UserProfileProvider.class).create(UserProfileContext.SCIM, model);
         Attributes attributes = profile.getAttributes();
         return attributes.getFirst(name);

@@ -16,6 +16,7 @@
 import org.keycloak.scim.filter.ScimFilterException;
 import org.keycloak.scim.protocol.ForbiddenException;
 import org.keycloak.scim.protocol.response.ErrorResponse;
+import org.keycloak.scim.resource.spi.ScimMutabilityException;
 import org.keycloak.scim.resource.spi.ScimPatchException;
 import org.keycloak.theme.Theme;
 
@@ -40,6 +41,8 @@ static Response toResponse(KeycloakSession session, Exception e) {
             return errorResponse(Status.CONFLICT, "uniqueness", "A resource with the same unique attribute already exists");
         } else if (e instanceof ScimFilterException) {
             return badRequest("invalidFilter", e.getMessage());
+        } else if (e instanceof ScimMutabilityException) {
+            return badRequest("mutability", e.getMessage());
         } else if (e instanceof ScimPatchException) {
             return badRequest("tooMany", e.getMessage());
         } else if (e instanceof ForbiddenException) {

@@ -112,11 +112,9 @@ public void testPatch() {
 
         expected = client.groups().get(expected.getId());
         expected.setDisplayName("Updated " + expected.getDisplayName());
-        expected.setExternalId(KeycloakModelUtils.generateId());
         adminEvents.clear();
         client.groups().patch(expected.getId(), PatchRequest.create()
                 .replace("displayName", expected.getDisplayName())
-                .replace("externalId", expected.getExternalId())
                 .build());
 
         AdminEventAssertion.assertSuccess(adminEvents.poll())
@@ -126,7 +124,133 @@ public void testPatch() {
 
         Group actual = client.groups().get(expected.getId());
         assertEquals(expected.getDisplayName(), actual.getDisplayName());
-        assertEquals(expected.getExternalId(), actual.getExternalId());
+    }
+
+    @Test
+    public void testPatchImmutableAttribute() {
+        Group group = new Group();
+        group.setDisplayName(KeycloakModelUtils.generateId());
+        group.setExternalId(KeycloakModelUtils.generateId());
+        group = client.groups().create(group);
+        String originalExternalId = group.getExternalId();
+        adminEvents.clear();
+
+        // PATCH replace on immutable externalId should fail
+        try {
+            client.groups().patch(group.getId(), PatchRequest.create()
+                    .replace("externalId", "new-value")
+                    .build());
+            fail("should fail because externalId is immutable");
+        } catch (ScimClientException sce) {
+            ErrorResponse error = sce.getError();
+            assertNotNull(error);
+            assertEquals(400, error.getStatusInt());
+            assertEquals("mutability", error.getScimType());
+            assertTrue(error.getDetail().contains("externalId"));
+        }
+
+        // PATCH add on immutable externalId should fail
+        try {
+            client.groups().patch(group.getId(), PatchRequest.create()
+                    .add("externalId", "new-value")
+                    .build());
+            fail("should fail because externalId is immutable");
+        } catch (ScimClientException sce) {
+            ErrorResponse error = sce.getError();
+            assertNotNull(error);
+            assertEquals(400, error.getStatusInt());
+            assertEquals("mutability", error.getScimType());
+        }
+
+        // PATCH remove on immutable externalId should fail
+        try {
+            client.groups().patch(group.getId(), PatchRequest.create()
+                    .remove("externalId")
+                    .build());
+            fail("should fail because externalId is immutable");
+        } catch (ScimClientException sce) {
+            ErrorResponse error = sce.getError();
+            assertNotNull(error);
+            assertEquals(400, error.getStatusInt());
+            assertEquals("mutability", error.getScimType());
+        }
+
+        // verify externalId was not changed
+        Group actual = client.groups().get(group.getId());
+        assertEquals(originalExternalId, actual.getExternalId());
+    }
+
+    @Test
+    public void testPatchInitializeImmutableAttribute() {
+        // create a group without externalId
+        Group group = new Group();
+        group.setDisplayName(KeycloakModelUtils.generateId());
+        group = client.groups().create(group);
+        assertNull(group.getExternalId());
+        adminEvents.clear();
+
+        // PATCH add on unset immutable externalId should succeed (RFC 7644 §3.5.2)
+        String externalId = KeycloakModelUtils.generateId();
+        client.groups().patch(group.getId(), PatchRequest.create()
+                .add("externalId", externalId)
+                .build());
+        Group actual = client.groups().get(group.getId());
+        assertEquals(externalId, actual.getExternalId());
+
+        // subsequent PATCH on the now-set externalId should fail
+        try {
+            client.groups().patch(group.getId(), PatchRequest.create()
+                    .add("externalId", "another-value")
+                    .build());
+            fail("should fail because externalId is already set and immutable");
+        } catch (ScimClientException sce) {
+            ErrorResponse error = sce.getError();
+            assertNotNull(error);
+            assertEquals(400, error.getStatusInt());
+            assertEquals("mutability", error.getScimType());
+        }
+
+        // verify externalId was not changed
+        actual = client.groups().get(group.getId());
+        assertEquals(externalId, actual.getExternalId());
+    }
+
+    @Test
+    public void testPatchReplaceInitializeImmutableAttribute() {
+        // create a group without externalId
+        Group group = new Group();
+        group.setDisplayName(KeycloakModelUtils.generateId());
+        group = client.groups().create(group);
+        assertNull(group.getExternalId());
+        adminEvents.clear();
+
+        // PATCH replace on unset immutable externalId should succeed (RFC 7644 §3.5.2)
+        String externalId = KeycloakModelUtils.generateId();
+        client.groups().patch(group.getId(), PatchRequest.create()
+                .replace("externalId", externalId)
+                .build());
+        Group actual = client.groups().get(group.getId());
+        assertEquals(externalId, actual.getExternalId());
+    }
+
+    @Test
+    public void testPatchImmutableMetaCreated() {
+        Group group = new Group();
+        group.setDisplayName(KeycloakModelUtils.generateId());
+        group = client.groups().create(group);
+        adminEvents.clear();
+
+        try {
+            client.groups().patch(group.getId(), PatchRequest.create()
+                    .replace("meta.created", "2020-01-01T00:00:00Z")
+                    .build());
+            fail("should fail because meta.created is immutable");
+        } catch (ScimClientException sce) {
+            ErrorResponse error = sce.getError();
+            assertNotNull(error);
+            assertEquals(400, error.getStatusInt());
+            assertEquals("mutability", error.getScimType());
+        }
     }
 
     @Test

@@ -824,6 +824,24 @@ public void testPatchExceedingMaxOperations() {
         assertTrue(ce.getError().getDetail().contains("maximum allowed number"));
     }
 
+    @Test
+    public void testPatchImmutableMetaCreated() {
+        User user = client.users().create(createUser());
+        adminEvents.clear();
+
+        try {
+            client.users().patch(user.getId(), PatchRequest.create()
+                    .replace("meta.created", "2020-01-01T00:00:00Z")
+                    .build());
+            fail("should fail because meta.created is immutable");
+        } catch (ScimClientException sce) {
+            ErrorResponse error = sce.getError();
+            assertNotNull(error);
+            assertEquals(400, error.getStatusInt());
+            assertEquals("mutability", error.getScimType());
+        }
+    }
+
     @Test
     public void testUserMembership() {
         GroupRepresentation groupA = createGroup("Group A");
-Original file line number
+Diff line change
@@ Expand Up @@
                     yield members.toList();
                 }
+                case "createdTimestamp" -> model.getCreatedTimestamp();
                 default -> null;
             };
         }
@@ Expand Down @@