[keycloak-user] Creating a federated user via REST API creates an incorrect entry in the CREDENTIAL table

[Rainer-Harbach Marian]

Hi everyone,

about two weeks ago I stumbled upon a phenomenon which I believe to be a 
bug in Keycloak. The error occurs when creating a new user via the REST 
API in a realm configured with LDAP user federation: The user is created 
in LDAP, but without a password -- instead, Keycloak creates an entry 
for the user in its internal CREDENTIAL database table.

When the user later changes their password, Keycloak writes the new 
password to LDAP, but keeps the old entry in the CREDENTIAL table. The 
user can then still only login with the old password.

I created a Jira ticket for this problem:
https://issues.jboss.org/browse/KEYCLOAK-5383

It would be very helpful to us if someone could check if they can 
reproduce the problem (maybe we are doing something wrong?) and if it's 
indeed a bug in Keycloak to give an estimate when it might be fixed.

The bug is a blocker in our project to deploy Keycloak for about 100k users.

Thanks,
Marian