[keycloak-user] New user, same e-mail

Niels Bertram nielsbne at gmail.com
Mon Jun 13 04:03:13 EDT 2016


Hey Felipe,

not sure if this will work for your case BUT perhaps try the following:

1. In realm admin go to User Federation
2. select your AD provider
3. select mappers tab

4. click on create mapper
5. name is contactEmail
6. select type as User Attribute
7. user model attribute contactEmail
8. LDAP attribute: mail
9. Save

(you will also have to reconfigure email templates to use contactEmail
instead of user model email)

10. click on email attribute mapper
11. change user model attribute to "unknown" which hopefully is not a user
attribute in your ldap and will trigger email to be removed from user model
once you load it in admin console or elsewhere
12. switch on "always read value from ldap" ! important !
13. Save

14. try to lookup your users in the the admin console

I was able to "remove" the unique constraint email field from a AD user
that way, once this user model field is empty, you can work with these
users again.

Let me know if you have any questions.
Niels



On Fri, Jun 10, 2016 at 10:10 PM, Felipe Braun Azambuja <
felipe.braun at intelbras.com.br> wrote:

> Hi Niels,
>
> I've read the JIRA issue, but it's not _exactly_ the case. The problem
> I'm facing is because I have two entries with the same address in Active
> Directory, and I can't change the old one in Keycloak because I have AD
> federated in read only mode.
>
> If I change the 'mail' entry in the AD object, it is not synced again if
> the data already exists in Keycloak? I did a test now with my own user,
> and it still shows the old value.
>
> Il 09/06/2016 18:58, Niels Bertram ha scritto:
>
>> Hi Felipe,
>>
>> this topic was discusses some time back on the user forum. Jira
>> KEYCLOAK-2141 <https://issues.jboss.org/browse/KEYCLOAK-2141> has some
>> background information on the issue you are facing. From what I can tell
>> one will have to change the attribute mapping on the LDAP user
>> federation provider to map email to a custom attribute (e.g.
>> contact_email) and then also change the email template to use that field
>> for email distribution instead.
>>
>> Cheers,
>> Niels
>>
>>
>> On Thu, Jun 9, 2016 at 9:41 PM, Felipe Braun Azambuja
>> <felipe.braun at intelbras.com.br <mailto:felipe.braun at intelbras.com.br>>
>>
>> wrote:
>>
>>     Hello all,
>>
>>     We have Keycloak connected to our Active Directory (read only),
>>     everything working correctly, authenticating our employees. But there
>> is
>>     a case that is a little complicated.
>>
>>     When someone starts working here as a intern, the user has an employee
>>     ID with four digits. If a person is a regular employee, it has five
>>     digits. Windows login is made of the first 2 letters of the name, and
>>     then the ID number, zero padded, as in *fe001173*. But there are times
>>     that these interns are hired as employees, so the previous account is
>>     *disabled* in AD and a new one is created.
>>
>>     The problem is that the e-mail address is the same. When this
>> happens, I
>>     can't even search the user in Keycloak admin interface, because it
>> says
>>     that it already has a user with the same e-mail. The old one is still
>>     there, though; but if I go to its details, I can't change the e-mail
>>     address, since it tries to sync it back to AD.
>>
>>     So far, the solution was changing it directly in the database and
>>     restarting Keycloak, which is *not* a good thing to do.
>>
>>     Any thoughts on what we could do?
>>
>>
>>     Thanks !
>>     --
>>     Felipe Braun Azambuja
>>     DBA
>>     Tecnologia da Informação e Comunicação
>>     (48) 3281 9577
>>     felipe.braun at intelbras.com.br <mailto:felipe.braun at intelbras.com.br>
>>     Esta mensagem, incluindo seus anexos, contém informações protegidas
>>     por lei, sujeitas a privilégios e/ou confidencialidades, não podendo
>>     ser retransmitida, arquivada, divulgada ou copiada sem autorização
>>     do remetente. O remetente utiliza o correio eletrônico no exercício
>>     do seu trabalho ou em razão dele, eximindo esta instituição de
>>     qualquer responsabilidade por utilização indevida. Caso tenha
>>     recebido esta mensagem por engano, por favor informe o remetente
>>     respondendo imediatamente a este e-mail, e em seguida apague-a do
>>     seu computador.
>>
>>     The information contained in this e-mail and its attachments are
>>     protected by law, subjected to privilege and/or confidentiality and
>>     cannot be retransmitted, filed, disclosed or copied without
>>     authorization from the sender. The sender uses the electronic mail
>>     in the exercise of his/her work or by virtue thereof, and the
>>     institution accepts no liability from its undue use. If you have
>>     received this message by mistake, please notify us immediately by
>>     returning the e-mail and deleting this message from your system.
>>
>>     _______________________________________________
>>     keycloak-user mailing list
>>     keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>
>>     https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>>
>>
> --
> Felipe Braun Azambuja
> DBA
> Tecnologia da Informação e Comunicação
> (48) 3281 9577
> felipe.braun at intelbras.com.br
> Esta mensagem, incluindo seus anexos, contém informações protegidas por
> lei, sujeitas a privilégios e/ou confidencialidades, não podendo ser
> retransmitida, arquivada, divulgada ou copiada sem autorização do
> remetente. O remetente utiliza o correio eletrônico no exercício do seu
> trabalho ou em razão dele, eximindo esta instituição de qualquer
> responsabilidade por utilização indevida. Caso tenha recebido esta mensagem
> por engano, por favor informe o remetente respondendo imediatamente a este
> e-mail, e em seguida apague-a do seu computador.
>
> The information contained in this e-mail and its attachments are protected
> by law, subjected to privilege and/or confidentiality and cannot be
> retransmitted, filed, disclosed or copied without authorization from the
> sender. The sender uses the electronic mail in the exercise of his/her work
> or by virtue thereof, and the institution accepts no liability from its
> undue use. If you have received this message by mistake, please notify us
> immediately by returning the e-mail and deleting this message from your
> system.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160613/747b9b63/attachment.html 


More information about the keycloak-user mailing list