Keycloak 15.02: Problem regarding AD-Sync (enable disabled Users)

noircc 0
Viewed 28

We got a Problem regarding the AD-Sync. In our Federation-Conf the "Edit Mode" is Unsynched, Version of Keycloak is 15.0.2.

  1. Sometimes it is behaving like Read-Only because you can't manually enable disabled user. If you click on enable:on, it right jumps back to enable:off
  2. Some Users, which are disabled, can't get enabled per AD-Sych.
  3. Also there is discrepancy between UI and DB, in the UI the User is disabled in the DB he/she is enabled.

This is so strange, and we deleted the cache. One thing we suspect is the infinispan cache...

keycloak active-directory
1 Answers

You may experience this behaviour because there may be a MSAD account controls mapper configured with your user federation. When that mapper is configured, Keycloak will "merge" the user state (enabled/disabled) from AD with the state stored in Keycloak. If either is disabled, Keycloak will mark the user as disabled.

Since you are using unsynched mode, Keycloak will only update its own database, but not the information stored in AD.

sventorben0
Related