SPI user.setEnabled(false) not working #41639

0Adiber · 2025-08-04T11:00:13Z

0Adiber
Aug 4, 2025

I have been trying to set all users in the realm to be disabled (in a custom provider I created) and I can't get it to work.
Also the provider works, the code works in general (I see logging output etc. so thats not the problem)
Below is the code for reference. I have tried using the "runJobInTransaction" function, I have tried using TransactionManager.begin() and .commit() manually, I also tried using EntityManager, but the property does not get updated. Or at least not always. Sometimes some of the users are disabled. I think it also has to do with caching.

The getAllUsers function returns correctly all users. I also checked the DB and there also the users still have the "enabled" property set to true.

For the LDAP full sync however, it can always update the property reliably back to true if I disable it manually, so it does not seem like a bug, but rather a mistake on my side on how I try to update the property. And YES, i have enabled "importUsers" in the LDAP settings, so thats not the problem. Like I said manually disabling works, but using user.setEnabled(false) for some reason does not (reliably) disable users.

Perhaps I need to "force" commit changes to the DB or update the property a different way. Please help me I am almost frustrated.

EDIT: I also tried literally setting the property in the DB (UPDATE user_entity SET enabled false;) ... still the UI shows all users as enabled, so definitely seems like a caching problem

KeycloakModelUtils.runJobInTransaction(sessionFactory, newSession -> {
  List<UserModel> users = [...].getAllUsers(newSession);

  for (UserModel u : users) {
     if (u.getUsername().equalsIgnoreCase("admin")) continue;
     u.setEnabled(false);
  }
});


public List<UserModel> getAllUsers(KeycloakSession session) {
   List<UserModel> users = new ArrayList<>();
   int batchSize = 1000;

   RealmModel realm = session.getContext().getRealm();

   EntityManager em = session.getProvider(JpaConnectionProvider.class).getEntityManager();

   int size = session.users().getUsersCount(realm);
   for(int offset = 0; offset < size; offset+=batchSize) {
       List<UserModel> batch = session.users().searchForUserStream(realm, Map.of(), offset, Math.min(batchSize, size - users.size())).toList();
       logger.debug("+  " + batch.size());
       users.addAll(batch);
       em.flush();
       em.clear();
       if(batch.size() < batchSize) break;
   }

   return users;
}

EDIT: removed testing code line

0Adiber · 2025-08-04T11:32:54Z

0Adiber
Aug 4, 2025
Author

Crazy stupid fix that works for now:

use EntityTransaction to update each UserEntity, then afterwards iterate through all users and call cache.evict(realm, user)

cache being session.getProvider(UserCache.class)

I doubt that this is the best way to do it, but its the only one that actually works for me at the moment

0 replies

Navigation Menu

Repository navigation

SPI user.setEnabled(false) not working #41639

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

SPI user.setEnabled(false) not working #41639

Uh oh!

Uh oh!

0Adiber Aug 4, 2025

Replies: 1 comment

Uh oh!

0Adiber Aug 4, 2025 Author

0Adiber
Aug 4, 2025

0Adiber
Aug 4, 2025
Author