diff --git a/charts/templates/configmap.yaml b/charts/templates/configmap.yaml
index 7c654fca7c071e56e447550342b72b6a9972664e..75e4d05724cc50982766e58a111e62d79cc0e101 100644
--- a/charts/templates/configmap.yaml
+++ b/charts/templates/configmap.yaml
@@ -3,18 +3,18 @@ kind: ConfigMap
 metadata:
   name: {{ .Chart.Name }}-configmap
 data:
-  SPRING_DATASOURCE_URL: "{{ .Values.db.url }}"
-  SPRING_DATASOURCE_USERNAME: "{{ .Values.db.username }}"
-  SPRING_DATASOURCE_PASSWORD: "{{ .Values.db.password }}"
+  SPRING_DATASOURCE_URL: {{ tpl .Values.db.url . | quote }}
+  SPRING_DATASOURCE_USERNAME: {{ .Values.db.username | quote }}
+  SPRING_DATASOURCE_PASSWORD: {{ .Values.db.password | quote }}
 
   KEYCLOAK_URL: "{{- include "microservices.backend.url" . }}/auth"
-  KEYCLOAK_APP_REALM: "{{ .Values.global.profile }}"
-  KEYCLOAK_MASTER_USER: "{{ .Values.keycloak.master.user }}"
+  KEYCLOAK_APP_REALM: {{ .Values.global.profile | quote }}
+  KEYCLOAK_MASTER_USER: {{ .Values.keycloak.master.user | quote }}
   KEYCLOAK_MASTER_PASSWORD: "{{ .Values.keycloak.master.password }}"
-  KEYCLOAK_CLIENT_TO_REALM_ROLE_MIGRATION_ENABLED: "{{ .Values.keycloak.clientToRealmRoleMigration.enabled }}"
+  KEYCLOAK_CLIENT_TO_REALM_ROLE_MIGRATION_ENABLED: {{ .Values.keycloak.clientToRealmRoleMigration.enabled | quote }}
   KEYCLOAK_CLIENT_TO_REALM_ROLE_MIGRATION_CLIENT_IDS: {{ .Values.keycloak.clientToRealmRoleMigration.clientIds | quote }}
 
-  CLIENT_AUTHORITY_URL: "{{- include "tls.gateway.url" . }}"
+  CLIENT_AUTHORITY_URL: {{- include "tls.gateway.url" . | quote }}
 
   {{- if ne ((.Values.databaseSeeding).roleIdentityAttributesMapping).enabled nil }}
   DATABASESEEDING_ROLEIDENTITYATTRIBUTESMAPPING_ENABLED: "{{ ((.Values.databaseSeeding).roleIdentityAttributesMapping).enabled }}"
@@ -23,4 +23,4 @@ data:
   DATABASESEEDING_ROLEIDENTITYATTRIBUTESMAPPING_FILEPATH: "{{ . }}"
   {{- end }}
 
-  MICROSERVICE_AUTHENTICATION_PROVIDER_URL: "{{ .Values.microservices.authenticationProviderUrl }}"
+  MICROSERVICE_AUTHENTICATION_PROVIDER_URL: {{ tpl .Values.microservices.authenticationProviderUrl . | quote }}
diff --git a/charts/values.yaml b/charts/values.yaml
index fdda87bd10c469951f2bf189c0512488e3c0e572..56d83a5526235969ec1cd4327ae1f1d91a235386 100644
--- a/charts/values.yaml
+++ b/charts/values.yaml
@@ -109,9 +109,9 @@ tolerations: []
 affinity: {}
 
 db:
-  url: "jdbc:postgresql://postgresql.{{ .Release.Namespace }}.svc.cluster.local:5432/usersroles"
-  username: "usersroles"
-  password: "usersroles"
+  url: jdbc:postgresql://postgresql.{{ .Release.Namespace }}.svc.cluster.local:5432/usersroles
+  username: usersroles
+  password: usersroles
 
 keycloak:
   master:
diff --git a/src/main/java/eu/europa/ec/simpl/usersroles/mappers/KeycloakMapper.java b/src/main/java/eu/europa/ec/simpl/usersroles/mappers/KeycloakMapper.java
index 10e27bbf2bd4eab008ff5f77ad2cb97d89e7d502..9fdab42ca5242d26cab18c58af5d079ee3c44558 100644
--- a/src/main/java/eu/europa/ec/simpl/usersroles/mappers/KeycloakMapper.java
+++ b/src/main/java/eu/europa/ec/simpl/usersroles/mappers/KeycloakMapper.java
@@ -12,7 +12,6 @@ import org.mapstruct.AnnotateWith;
 import org.mapstruct.Mapper;
 import org.mapstruct.Mapping;
 import org.mapstruct.MappingTarget;
-import org.mapstruct.NullValuePropertyMappingStrategy;
 
 @Mapper
 @AnnotateWith(Generated.class)
@@ -26,10 +25,7 @@ public interface KeycloakMapper {
     @Mapping(target = "roles", source = "roleList")
     KeycloakUserDTO toDto(UserRepresentation userRepresentation, List<String> roleList);
 
-    @Mapping(
-            source = "password",
-            target = "credentials",
-            nullValuePropertyMappingStrategy = NullValuePropertyMappingStrategy.IGNORE)
+    @Mapping(target = "credentials", ignore = true)
     @Mapping(target = "username", ignore = true)
     void updateEntity(KeycloakUserDTO dto, @MappingTarget UserRepresentation entity);
 
diff --git a/src/main/java/eu/europa/ec/simpl/usersroles/services/KeycloakUserService.java b/src/main/java/eu/europa/ec/simpl/usersroles/services/KeycloakUserService.java
index 659a515012443c377473f05d9db4440a774d5cb7..89da05d5ad7112711c9b492a77418e8b6b752337 100644
--- a/src/main/java/eu/europa/ec/simpl/usersroles/services/KeycloakUserService.java
+++ b/src/main/java/eu/europa/ec/simpl/usersroles/services/KeycloakUserService.java
@@ -4,14 +4,18 @@ import eu.europa.ec.simpl.common.filters.KeycloakUserFilter;
 import eu.europa.ec.simpl.common.model.dto.usersroles.KeycloakRoleDTO;
 import eu.europa.ec.simpl.common.model.dto.usersroles.KeycloakUserDTO;
 import eu.europa.ec.simpl.common.model.dto.usersroles.RoleDTO;
+import eu.europa.ec.simpl.common.model.validators.CreateOperation;
 import eu.europa.ec.simpl.usersroles.exceptions.KeycloakException;
+import jakarta.validation.Valid;
 import jakarta.ws.rs.ClientErrorException;
 import java.util.List;
 import java.util.UUID;
 import org.keycloak.representations.idm.RoleRepresentation;
+import org.springframework.validation.annotation.Validated;
 
 public interface KeycloakUserService {
-    String createUser(KeycloakUserDTO userDTO);
+    @Validated(CreateOperation.class)
+    String createUser(@Valid KeycloakUserDTO userDTO);
 
     KeycloakUserDTO getUserByEmail(String email);
 
diff --git a/src/main/java/eu/europa/ec/simpl/usersroles/services/impl/KeycloakUserServiceImpl.java b/src/main/java/eu/europa/ec/simpl/usersroles/services/impl/KeycloakUserServiceImpl.java
index dd98d238de9b46b4df351ac18b1140e7e2953bad..7319db6b0635e837857680c668fd090f7e609d47 100644
--- a/src/main/java/eu/europa/ec/simpl/usersroles/services/impl/KeycloakUserServiceImpl.java
+++ b/src/main/java/eu/europa/ec/simpl/usersroles/services/impl/KeycloakUserServiceImpl.java
@@ -247,6 +247,7 @@ public class KeycloakUserServiceImpl implements KeycloakUserService {
             var representation = userResource.toRepresentation();
             keycloakMapper.updateEntity(userDTO, representation);
             userResource.update(representation);
+            updateUserRoles(uuid, userDTO.getRoles());
         } catch (ClientErrorException e) {
             throw new KeycloakException(e.getResponse());
         }