Changing a username while keeping the email unchanged leads to 409 conflict

[tobilarscheid]

Current Behavior

1. Create a realm.yaml that contains a user with a name and an email address
2. Run keycloak-config-cli to apply the realm.yaml
3. Change the realm.yaml so that the user's email stays the same but the username is changed
4. Rerun keycloak-config-cli --> error, 409 Conflict

Expected Behavior

A new user with the new name should be created, the old user should disappear

Steps To Reproduce

No response

Environment

• Keycloak Version: 16.0.1
• keycloak-config-cli Version: latest
• Java Version: 11

Anything else?

No response

[jkroepke]

Deleting users is currently not implemented in keycloak-config-cli, only create and update.

Thats why keycloak-config-cli will not delete the old user and the new user has a conflict with the existing user.

[tobilarscheid]

I understand, thanks for the quick reply! Happy to provide a PR if you point me in the right direction.

[jkroepke]

For deleting users, a remote state needs to be implement. Otherwise, Keycloak-config-cli is going to delete all users which is a major incident.

More informations here: https://github.com/adorsys/keycloak-config-cli/blob/main/docs/MANAGED.md

Take a look, how Realm Roles are handled on deletion.

https://github.com/adorsys/keycloak-config-cli/blob/1a22b22462b95ac96a5ea14cd3d4ea1f801d5568/src/main/java/de/adorsys/keycloak/config/service/RoleImportService.java#L243-L269

[github-actions[bot]]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

[testuser7]

Is there any plan to add the remote state feature?

[tobilarscheid]

Hi @testuser7 (what a name ;-) ), I haven't looked into it so far!