LDAP users get deleted when searching users. #16159

Plichezi · 2022-12-22T14:37:05Z

Plichezi
Dec 22, 2022

Hello,
I have created a user federation(keycloak 19.3) that syncs users from LDAP. After importing the users(they are present in database) and pushing 'View all users' in Users tab, no users are displayed. In logs I can find logs about 'Creating LdapContext' and then 'Removed invalid user john.doe' for 20 consecutive users(they are removed from keycloak database). No other logs related to this could be found. Also when searching for particular user, the user shows up in the table but after selecting said user I get 'No resource found' page. In logs there is a trace of successful ldap search for user and then(after selecting user) 'Removed invalid user john.doe'. I am not sure if this could be attribute mapping problem since on other keycloak(11.0.3) instance with identical federation/mapping setup there is no such issue. I am able to search for internal users. Will appreciate any ideas of what could be the problem here.

Answered by coderamblings

Dec 27, 2022

We've found the reason for this behaviour: incorrect settings of the configured ldap federation provider.
The "UUID LDAP attribute" was set to the default entryUUID value, when we have no such field in our ldap provider.
Interestingly, synchronization went through, but as @Plichezi mentioned, users were getting removed and resynced to Keycloak even upon a search for them in the UI --> Users panel.
Also interestingly, we have "UUID LDAP attribute" set to "entryUUID" in the old, operational 11.0.3 instance, so how it's treated must have been changed - which is not a big surprise considering a jump from 11.x to 19.x

View full answer

coderamblings · 2022-12-27T13:40:41Z

coderamblings
Dec 27, 2022

We've found the reason for this behaviour: incorrect settings of the configured ldap federation provider.
The "UUID LDAP attribute" was set to the default entryUUID value, when we have no such field in our ldap provider.
Interestingly, synchronization went through, but as @Plichezi mentioned, users were getting removed and resynced to Keycloak even upon a search for them in the UI --> Users panel.
Also interestingly, we have "UUID LDAP attribute" set to "entryUUID" in the old, operational 11.0.3 instance, so how it's treated must have been changed - which is not a big surprise considering a jump from 11.x to 19.x

0 replies

Navigation Menu

Repository navigation

LDAP users get deleted when searching users. #16159

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

LDAP users get deleted when searching users. #16159

Uh oh!

Plichezi Dec 22, 2022

Replies: 1 comment

Uh oh!

coderamblings Dec 27, 2022

Plichezi
Dec 22, 2022

coderamblings
Dec 27, 2022