Problem statement

The current implementation of the Map storage proceeds as follows for creating a new realm role:

• RealmCacheSession#addRealmRole(RealmModel realm, String name) that will generate an ID for the role as UUID
• other map transactions create the ID when create() is called
• when creating the entity in LDAP, the LDAP will decide about the UUID on creation time, and it can't be passed by the caller. For other stores, writing to the store would usually be done at the end of the transaction

Approach

The first part seems quite clear: Remove code to create ID from RealmCacheSession

Then it gets tricky, here a first approach:

• instead of creating the entity at the end of the transaction, call LDAP from LdapRoleMapKeycloakTransaction#create(MapRoleEntity value) to create an entity and get the GUID that will be used as ID. When the transaction is rolled back, the entity would need to be removed.

Benefits

• Using a GUID would not leak DN information outside the LDAP storage provider.

Alternatives

• Use the DN of the entity that could be determined at the time LdapRoleMapKeycloakTransaction#create is being called. Only during commit the entity is created in LDAP as usual.

Benefit (or downside?) of a DN would be that an entity or a directory could be re-created with the same DNs, while it can't be re-created with the same GUIDs.

Other

• References inside LDAP (for example "member" and "memberOf" attributes) are stored as DN as well (probably for a reason), and it would be more human readable.