I think it should be optional. Someone may for example migrate from LDAP to using Keycloak. Once they've migrated all apps they'll want to decommission the LDAP server, but they would still want to keep the users. ----- Original Message ----- > From: "Bill Burke" <bburke(a)redhat.com&gt; > To: keycloak-dev(a)lists.jboss.org > Sent: Thursday, 31 July, 2014 3:05:31 PM > Subject: [keycloak-dev] delete users on federation removal? > > I'm assuming that if a UserFederationProvider is removed from a realm, > then all users imported from that provider should be deleted? > > -- > Bill Burke > JBoss, a division of Red Hat > http://bill.burkecentral.com > _______________________________________________ > keycloak-dev mailing list > keycloak-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-dev > _______________________________________________ keycloak-dev mailing list keycloak-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-dev

Ya, this is quite hairy. You'll have to set the REQUIRED ACTION to reset all credentials handled by the federation provider. Unfortunately, you can now only set one required action per user :( On 7/31/2014 3:05 PM, Marek Posolda wrote: > +1 for having it optional. > > However if you remove LDAP UserFederationProvider, the users from LDAP > won't be able to login with their passwords until admin change them... > > Marek > > On 31.7.2014 16:09, Stian Thorgersen wrote: >> I think it should be optional. >> >> Someone may for example migrate from LDAP to using Keycloak. Once they've migrated all apps they'll want to decommission the LDAP server, but they would still want to keep the users. >> >> ----- Original Message ----- >>> From: "Bill Burke" <bburke(a)redhat.com&gt; >>> To: keycloak-dev(a)lists.jboss.org >>> Sent: Thursday, 31 July, 2014 3:05:31 PM >>> Subject: [keycloak-dev] delete users on federation removal? >>> >>> I'm assuming that if a UserFederationProvider is removed from a realm, >>> then all users imported from that provider should be deleted? >>> >>> -- >>> Bill Burke >>> JBoss, a division of Red Hat >>> http://bill.burkecentral.com >>> _______________________________________________ >>> keycloak-dev mailing list >>> keycloak-dev(a)lists.jboss.org >>> https://lists.jboss.org/mailman/listinfo/keycloak-dev >>> >> _______________________________________________ >> keycloak-dev mailing list >> keycloak-dev(a)lists.jboss.org >> https://lists.jboss.org/mailman/listinfo/keycloak-dev > > _______________________________________________ > keycloak-dev mailing list > keycloak-dev(a)lists.jboss.org > https://lists.jboss.org/mailman/listinfo/keycloak-dev >

From: "Bill Burke" <bburke(a)redhat.com&gt; To: keycloak-dev(a)lists.jboss.org Sent: Thursday, 31 July, 2014 11:52:45 PM Subject: Re: [keycloak-dev] delete users on federation removal? HOnestly I think we should just delete all users that have the link and deferr the rest until after 1.1. This will take a lot of work and there is a lot of little things that need to be done. On 7/31/2014 6:16 PM, Bill Burke wrote: > Even more hairy, you can't reset a password without knowing (and > verifying) the old one. > > > > On 7/31/2014 6:01 PM, Bill Burke wrote: >> Ya, this is quite hairy. You'll have to set the REQUIRED ACTION to >> reset all credentials handled by the federation provider. >> >> Unfortunately, you can now only set one required action per user :( >> >> On 7/31/2014 3:05 PM, Marek Posolda wrote: >>> +1 for having it optional. >>> >>> However if you remove LDAP UserFederationProvider, the users from LDAP >>> won't be able to login with their passwords until admin change them... >>> >>> Marek >>> >>> On 31.7.2014 16:09, Stian Thorgersen wrote: >>>> I think it should be optional. >>>> >>>> Someone may for example migrate from LDAP to using Keycloak. Once >>>> they've migrated all apps they'll want to decommission the LDAP server, >>>> but they would still want to keep the users. >>>> >>>> ----- Original Message ----- >>>>> From: "Bill Burke" <bburke(a)redhat.com&gt; >>>>> To: keycloak-dev(a)lists.jboss.org >>>>> Sent: Thursday, 31 July, 2014 3:05:31 PM >>>>> Subject: [keycloak-dev] delete users on federation removal? >>>>> >>>>> I'm assuming that if a UserFederationProvider is removed from a realm, >>>>> then all users imported from that provider should be deleted? >>>>> >>>>> -- >>>>> Bill Burke >>>>> JBoss, a division of Red Hat >>>>> http://bill.burkecentral.com >>>>> _______________________________________________ >>>>> keycloak-dev mailing list >>>>> keycloak-dev(a)lists.jboss.org >>>>> https://lists.jboss.org/mailman/listinfo/keycloak-dev >>>>> >>>> _______________________________________________ >>>> keycloak-dev mailing list >>>> keycloak-dev(a)lists.jboss.org >>>> https://lists.jboss.org/mailman/listinfo/keycloak-dev >>> >>> _______________________________________________ >>> keycloak-dev mailing list >>> keycloak-dev(a)lists.jboss.org >>> https://lists.jboss.org/mailman/listinfo/keycloak-dev >>> >> > -- Bill Burke JBoss, a division of Red Hat http://bill.burkecentral.com _______________________________________________ keycloak-dev mailing list keycloak-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-dev

----- Original Message ----- > From: "Bill Burke" <bburke(a)redhat.com&gt; > To: keycloak-dev(a)lists.jboss.org > Sent: Thursday, 31 July, 2014 11:01:12 PM > Subject: Re: [keycloak-dev] delete users on federation removal? > > Ya, this is quite hairy. You'll have to set the REQUIRED ACTION to > reset all credentials handled by the federation provider. > > Unfortunately, you can now only set one required action per user :( You can still set multiple. The user has a Set<RequiredAction> and we even have a test that checks users with multiple actions RequiredActionMultipleActionsTest.

----- Original Message ----- > From: "Bill Burke" <bburke(a)redhat.com&gt; > To: "Stian Thorgersen" <stian(a)redhat.com&gt; > Cc: keycloak-dev(a)lists.jboss.org > Sent: Friday, 1 August, 2014 2:23:39 PM > Subject: Re: [keycloak-dev] delete users on federation removal? > > > > On 8/1/2014 4:18 AM, Stian Thorgersen wrote: >> >> ----- Original Message ----- >>> From: "Bill Burke" <bburke(a)redhat.com&gt; >>> To: keycloak-dev(a)lists.jboss.org >>> Sent: Thursday, 31 July, 2014 11:01:12 PM >>> Subject: Re: [keycloak-dev] delete users on federation removal? >>> >>> Ya, this is quite hairy. You'll have to set the REQUIRED ACTION to >>> reset all credentials handled by the federation provider. >>> >>> Unfortunately, you can now only set one required action per user :( >> You can still set multiple. The user has a Set<RequiredAction> and we even >> have a test that checks users with multiple actions >> RequiredActionMultipleActionsTest. >> > Ugh, I'm really sorry. I think I remembered you saying you were going > to switch it to one action, looked at the code quickly and missed the > Set<RequiredAction> method on UserModel...I AM LOSING MY MIND!!!! Honest mistake, I switched the authorization code so it's only valid for one action at a time. So if a user has multiple required actions, the code will be set to the first one, then the user redirect to that action page, then the code will be updated with the new action + timestamp refreshed, redirected to next action page, etc.. Keeping the spirit of code is a one-time-thing alive ;) > Still not sure what to do about credentials though. We can't have open > accounts that can be reset without specifying old password. We could > send out an email maybe. > > Must be deferred to post 1.0.final. +1 To deferre it One related thing I think we'll need is the ability to do batch updates to users. For example an admin may want to: * Require a group of users to update their password * Disable a group of users * Add a role to a group of users Not sure how the admin would specify the group though, maybe by role? > > -- > Bill Burke > JBoss, a division of Red Hat > http://bill.burkecentral.com > _______________________________________________ keycloak-dev mailing list keycloak-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-dev