Repository navigation
Admin Users Endpoint Enabled Query Parameter Not Working #9838
Description
Describe the bug
Hello,
When calling the GET /{realm}/users endpoint with the optional query parameters enabled and search specified, the enabled attribute has no effect.
All users matching the search query are returned, disregarding their enabled status.
When specifying the enabled query parameter without additional query parameters, the endpoint works as expected, returning users filtered according to their status.
It seems like this is a bug, because the parameters are neither interpreted as logical AND, nor as logical OR.
Ideally, the users would be filtered by both values, returning only users that match the search AND have the correct enabled value as specified.
Thanks a lot for your help!
EDIT:
I found the related API here: https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/services/resources/admin/UsersResource.java#L285
Looks like there is a special case defined when the search parameter is specified. Is this required, or can the enabled filter be used in this case as well?
Version
16.1.0
Expected behavior
Users are filtered with query parameters combined as logical AND
Actual behavior
enabled filter does not have any effect when search parameter is specified.
How to Reproduce?
- create 2 users in a realm with similar names
- enable one user and disable the other one
- create a search query that matches both users
curl --request GET 'localhost:8080/auth/admin/realms/test/users?enabled=false&search=matchbothusers'
Both users will be returned, when actually only the user with enabled=false should be returned.
Anything else?
It would be nice to have the same functionality also for the /users/count endpoint
See: #9842
Activity
abstractj commentedon Mar 2, 2022
@stianst @msvechla I don't think it's a bug. Based on your docs, that's not supported currently by our API:
"It can be called in three different ways.
As a feature request, it makes sense, at the same time we need to take into consideration the API performance.
msvechla commentedon Mar 3, 2022
@abstractj This comment only exists for the
endpoint.
This request is about the
endpoint. I just also mentioned the
countendpoint as a nice to have, to have a matching behavior here.Or is this description also valid for the regular
usersendpoint? Then I think this should be reflected in the docs as well.zacisco commentedon Nov 3, 2022
hello
we user keycloak 18 and 19
request with /users?enabled=false - don't work for users from AD ... i got 0 users,but i have 1 disabled
rmartinc commentedon Mar 1, 2023
@msvechla Yes, this is more or less a historical reason. As @abstractj commented the search and count endpoint use the
searchparameter exclusively, I mean, if search is used the rest of options are not taken into account. You can use any other parameter and it will be appended as and. For example:email=santi@lala.com&enabled=false&q=attr1:value.Similar to #11676 (or the same). As commented in the other issue, I think this is a minor issue. I'm going to assign the help-wanted and move it to backlog. If someone wants to help here it would be much appreciated.
I don't know if for this the best way of moving forward is improving the documentation (javadoc) to exaplain this. As modifying the behavior now can also trigger complains.
pedroigor commentedon Mar 7, 2024
Closing as a duplicate of #11676 (comment).