You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
LDAP: remove users deleted in LDAP during full sync - #55026
Adds 'removeInvalidUsersOnSync' option (default off) to the LDAP provider. Full sync collects LDAP_IDs returned by LDAP and removes local users linked to the provider whose LDAP_ID is missing. Removal is skipped if LDAP returns no users at all.
Adds 'removeInvalidUsersOnSync' option (default off) to the LDAP provider.
Full sync collects LDAP_IDs returned by LDAP and removes local users linked
to the provider whose LDAP_ID is missing. Removal is skipped if LDAP returns
no users at all.
Closeskeycloak#35235
Signed-off-by: Ibragim <57891324+eastana@users.noreply.github.com>
Adds opt-in removal of stale LDAP-imported users during full synchronization, addressing #35235. The option defaults to off and skips removal when LDAP returns no users.
Changes:
Collects LDAP IDs during full sync and removes linked local users absent from the results.
Adds a paginated local-storage API for reading imported user IDs and attributes without LDAP validation.
Exposes the option in the Admin Console and adds an integration test.
- Skip removal when the LDAP scan may be incomplete (paged results
response control missing, entries without UUID)
- Only consider users snapshotted before the LDAP scan
- Re-check federation link and LDAP_ID before removing a user
- Publish UserPreRemovedEvent before removal
- Support LDAP_ID values stored in longValue
- Persist the option in the test, as the sync task reloads the model
Signed-off-by: Ibragim <57891324+eastana@users.noreply.github.com>
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
Incomplete LDAP scans and a non-atomic ownership re-check can wrongly delete imported users still present in LDAP or users concurrently unlinked from LDAP.
The removed count is incremented before runJobInTransaction() commits, so a commit failure caught below reports the user as both removed and failed even though deletion rolled back. Return the deletion result from runJobInTransactionWithResult() and increment the counter only after the transaction completes successfully.
logger.warnf("LDAP user query for federation provider '%s' in realm '%s' may have returned incomplete results. Skipping removal of invalid users to prevent accidental data loss.",
model.getName(), realmId);
return;
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds 'removeInvalidUsersOnSync' option (default off) to the LDAP provider. Full sync collects LDAP_IDs returned by LDAP and removes local users linked to the provider whose LDAP_ID is missing. Removal is skipped if LDAP returns no users at all.
Closes #35235