Repository navigation
Clean up approach on Broker links are not cleaned up for deleted users #45125
Rathan-Naik
started this conversation in
Ideas
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Hi team,
I've been investigating issue #44933 and would like to discuss my findings and proposed approach before submitting a PR.
Analysis:
I've investigated this issue and found that it affects both storage modes:
Federated Storage - JpaUserFederatedStorageProvider.getUserByFederatedIdentity() throws IllegalStateException when multiple BrokerLinkEntity records exist for the same broker_user_id
Internal User Storage - JpaUserProvider.getUserByFederatedIdentity() has the same issue with multiple FederatedIdentityEntity records
Root Cause:
When a federated user (e.g., from LDAP) is deleted from the external source, the broker link record in Keycloak is not cleaned up. If a new user with the same IdP mapping logs in later, a second broker link is created. On subsequent logins, the query returns multiple results and throws:
throw new IllegalStateException("More results found for identityProvider=" + link.getIdentityProvider() + ...)
Proposed Fix:
In both JpaUserFederatedStorageProvider and JpaUserProvider, when multiple results are found:
Iterate through each result
This approach cleans up stale data automatically while preserving the error for genuine duplicate scenarios.
PR for the above approach
Cleanup orphaned broker links when duplicate federated identities found: #45124
Questions for Discussion:
All reactions