Users getting 401 "Unauthorized" error after direct database credential/session deletion - Keycloak 26.3.0 #44309

ismailmuhmad · 2025-11-18T20:17:56Z

ismailmuhmad
Nov 18, 2025

Environment

Keycloak Version: 26.3.0
Deployment: Kubernetes (multiple pods)
Database: Oracle
Issue: Persistent 401 errors after database manipulation

Problem Description

After directly deleting user credentials and sessions from the database, all users are experiencing 401 "Unauthorized" errors when attempting to login, even after passwords have been reset.

Error shown to users:

{"code":"401","message":"Unauthorized - Contact Administrator with this error"}

What We Did

We executed the following SQL operations directly on the Keycloak database for specific users:

-- Delete user passwords
DELETE FROM CREDENTIAL WHERE TYPE = 'password' 
  AND USER_ID IN (
    SELECT ID FROM USER_ENTITY 
    WHERE USERNAME IN (<ALL_USERNAMES>)
  );

-- Delete offline client sessions
DELETE FROM OFFLINE_CLIENT_SESSION 
WHERE USER_SESSION_ID IN (
  SELECT USER_SESSION_ID FROM OFFLINE_USER_SESSION
  WHERE USER_ID IN (
    SELECT ID FROM USER_ENTITY 
    WHERE USERNAME IN (<ALL_USERNAMES>)
  )
);

-- Delete offline user sessions
DELETE FROM OFFLINE_USER_SESSION 
WHERE USER_ID IN (
  SELECT ID FROM USER_ENTITY 
  WHERE USERNAME IN (<ALL_USERNAMES>)
);

Current Behavior

Users attempt to login with new passwords
During the OAuth callback, users receive 401 error
Workaround: Users must clear browser cache/cookies to login successfully
After clearing cache, login works fine

Errors from keycloak pod logs

REFRESH_TOKEN_ERROR - Tokens marked as "not active" after session deletion
CODE_TO_TOKEN_ERROR - Authorization codes cannot be exchanged for tokens
Failed Password Validation - User credentials deleted from database
AuthenticationFlowException - Missing user session data during authentication
Session Not Found - User sessions missing from cache and database

What We've Tried

✅ Password reset via Admin Console - Users have valid passwords now
✅ Scaled all Kubernetes pods to 0, then back up - Cache should be cleared
But 401 issue still exist! Any guidance would be greatly appreciated!

Navigation Menu

Repository navigation

Users getting 401 "Unauthorized" error after direct database credential/session deletion - Keycloak 26.3.0 #44309

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Users getting 401 "Unauthorized" error after direct database credential/session deletion - Keycloak 26.3.0 #44309

Uh oh!

Uh oh!

ismailmuhmad Nov 18, 2025

Environment

Problem Description

What We Did

Current Behavior

Errors from keycloak pod logs

What We've Tried

Replies: 0 comments

ismailmuhmad
Nov 18, 2025