Re: [keycloak-user] Uniqueness of user properties

Stian, would we be able to collaborate on removing the uniqueness of email a bit further? We have non-unique emails for a very large number of accounts and can't use keycloak in its current form. In our case username is unique but email is not and never will be. From what I can see following use cases would need consideration making email non-unique. - login (username or email) , in case of email non-uniqueness accepting email as login will need to be disabled - forget username, in this case one would not be able to recover a username if email can be present in multiple accounts - forget password, accepting email as login will need to be disabled Are there any other use cases that could be impacted? Thanks Niels On Tue, Apr 12, 2016 at 5:16 PM, Guus der Kinderen < guus.der.kinderen(a)gmail.com&gt; wrote: > Yes, that makes sense. > > In the way I use the admin client, I created a challenge in my > application. Every time someone logs in, I simply check delegate that > attempt to Keycloak. I won't know if the user was deleted and recreated in > the mean time. Pretty likely, the credentials will have changed, but that's > not a good indicator to determine if the user attributes that I store in my > app should be purged. > > For now, all user management will be done in my app (propagating all > changes to Keycloak), but at some point, this is going to hurt me... > > On 12 April 2016 at 09:04, Stian Thorgersen <sthorger(a)redhat.com&gt; wrote: > >> BTW this is main reason token subject is User ID not username, to >> guarantee uniqueness over time. >> >> On 12 April 2016 at 09:03, Stian Thorgersen <sthorger(a)redhat.com&gt; wrote: >> >>> >>> >>> On 12 April 2016 at 08:58, Guus der Kinderen < >>> guus.der.kinderen(a)gmail.com&gt; wrote: >>> >>>> Hmm... that rename route is disabled by default though? >>>> >>> >>> Yes >>> >>> >>>> >>>> Also, when deleting a user, are we guaranteed that all user artifacts >>>> are removed? I'd hate to see another user (years later) have access to >>>> things simply because he picked a previously used name. Then again, most >>>> artifacts (if not all) will probably be linked through the ID, not username. >>>> >>> >>> Everything in Keycloak is linked through ID, not username. Obviously >>> you may use username in your app rather than ID, in which case that may be >>> a problem in your app. In that case you should probably disable a >>> decommissioned user rather than disable or change your app. >>> >>> >>>> >>>> On 12 April 2016 at 06:32, Stian Thorgersen <sthorger(a)redhat.com&gt; >>>> wrote: >>>> >>>>> There's an option to enable users to change their username. Enabling >>>>> that could result in a user renaming the username, then another user taking >>>>> the same username. There's also the situation where a user with a specific >>>>> username is deleted, then another user is created with the same username >>>>> (maybe years after). >>>>> >>>>> On 12 April 2016 at 01:31, Guus der Kinderen < >>>>> guus.der.kinderen(a)gmail.com&gt; wrote: >>>>> >>>>>> Thanks for the feedback, Niels, >>>>>> >>>>>> I am primarily concerned about the email address, but as another >>>>>> attribute than the username is used to identify things, I thought I'd make >>>>>> sure and include that in the question too. >>>>>> >>>>>> At some point, my customer will probably want non-unique email >>>>>> addresses. It's good to know it's at least on the roadmap. >>>>>> >>>>>> Regards, >>>>>> >>>>>> Guus >>>>>> >>>>>> On 12 April 2016 at 00:50, Niels Bertram <nielsbne(a)gmail.com&gt; wrote: >>>>>> >>>>>>> Hi Guus, >>>>>>> >>>>>>> I can't see how you could manage non-uniqueness of the username as >>>>>>> you will need at least one user side unique identifier to drive forget >>>>>>> password flow. But the option to have email non-unique has been discussed a >>>>>>> while back in the user forum and there is this open Jira >>>>>>> https://issues.jboss.org/browse/KEYCLOAK-2141. >>>>>>> >>>>>>> We have been looking at non-unique emails and essentially one will >>>>>>> have to remove the functionality of using email as a form of login from the >>>>>>> login flow leaving the user to only be able to use their assigned or >>>>>>> selected username as option. We have been trying to "hack" the codebase a >>>>>>> bit but have not been too successful in getting keycloak to work properly >>>>>>> with non-unique emails :( ... >>>>>>> >>>>>>> Cheers, >>>>>>> Niels >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> On Tue, Apr 12, 2016 at 3:08 AM, Guus der Kinderen < >>>>>>> guus.der.kinderen(a)gmail.com&gt; wrote: >>>>>>> >>>>>>>> Hello, >>>>>>>> >>>>>>>> Keycloak uses a UUID value to identify a uses. Basic questions: >>>>>>>> through some form of configuration: >>>>>>>> >>>>>>>> - Can more than two users exist that have an identical >>>>>>>> username? >>>>>>>> - Can more than two users exist that have an identical email >>>>>>>> address? >>>>>>>> >>>>>>>> Regards, >>>>>>>> >>>>>>>> Guus >>>>>>>> >>>>>>>> _______________________________________________ >>>>>>>> keycloak-user mailing list >>>>>>>> keycloak-user(a)lists.jboss.org >>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user >>>>>>>> >>>>>>> >>>>>>> >>>>>> >>>>>> _______________________________________________ >>>>>> keycloak-user mailing list >>>>>> keycloak-user(a)lists.jboss.org >>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user >>>>>> >>>>> >>>>> >>>> >>> >> >