Delete user error "User name is missing"

Getting advice
1

Hello,
Some users do not have a username, so changing or deleting it is not possible.
background
The users log in via saml-IdP, which becomes the user
created in keycloack, all attributes are visible, including username. After a while the username is missing, only email, last name and first name are visible.
The Command “bin/kcadm.sh get users -r xxx” lists the users, some have usernames, others don’t.
Delete user: “bin/kcadm.sh delete users/… -r xxx” → “For more on this error consult the server log. [unknown_error]”
keycloak.log:

 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (executor-thread-106) Uncaught server error: java.lang.NullPointerException
        at java.base/java.util.Objects.requireNonNull(Objects.java:233)
        at org.keycloak.models.cache.infinispan.events.UserUpdatedEvent.<init>(UserUpdatedEvent.java:44)
        at org.keycloak.models.cache.infinispan.events.UserUpdatedEvent.create(UserUpdatedEvent.java:50)
        at org.keycloak.models.cache.infinispan.UserCacheSession.registerUserInvalidation(UserCacheSession.java:128)
        at org.keycloak.models.cache.infinispan.UserAdapter.getDelegateForUpdate(UserAdapter.java:105)
        at org.keycloak.models.cache.infinispan.UserAdapter.invalidate(UserAdapter.java:120)
        at org.keycloak.models.cache.infinispan.UserCacheSession.fullyInvalidateUser(UserCacheSession.java:836)
        at org.keycloak.models.cache.infinispan.UserCacheSession.removeUser(UserCacheSession.java:850)
        at org.keycloak.models.UserManager.removeUser(UserManager.java:36)
        at org.keycloak.models.UserManager.removeUser(UserManager.java:32)
        at org.keycloak.services.resources.admin.UserResource.deleteUser(UserResource.java:648)
        at org.keycloak.services.resources.admin.UserResource$quarkusrestinvoker$deleteUser_1ab1e247046f32b48fb55de7f71f5540f6c8ea14.invoke(Unknown Source)
        at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29)
        at io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:141)
        at org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:147)
        at io.quarkus.vertx.core.runtime.VertxCoreRecorder$14.runWith(VertxCoreRecorder.java:635)
        at org.jboss.threads.EnhancedQueueExecutor$Task.doRunWith(EnhancedQueueExecutor.java:2516)
        at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2495)
        at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1521)
        at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:11)
        at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:11)
        at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
        at java.base/java.lang.Thread.run(Thread.java:1583)

sure, because username is null.

Does anyone have an idea how I can solve the problem?

regards
Thomas

2

Strange, username in Keycloak is required field, you can change under Realm Settings/ User Profile required fields like email, firstName and lastName, but not username. When user is created from IdP and your IdP does not provide username attribute and you don’t map it, Keycloak will generate username, something like this:

image
image1432×146 11 KB

Do you have any mapper for username or behavior is default?

3

Yes, I have a mapper IdP(uid) → keycloak(username).
It’s quite strange. All attributes (email, username, lastname, firstname) are synchronized by force and are initially visible. The username is missing for 2 users at once. This means that I can no longer make changes or delete any changes to these users. Users can no longer log in. It’s currently just a test system and I could delete the entire realm and just have to create everything again. But I thought there was a back door through which I could delete the affected users. Unfortunately, deleting via both WEB and cli interfaces does not work.
Are there any other alternatives?

4

I also use a SAML based IdP for login. And I also had a situation, where a keycloak user’s username was empty (empty or null, I do not know, I never tried to delete the user).

But the empty username was filled correctly after the user’s next login via the IdP. I use a “username template importer” mapper to fill the keyloak username with SAML attribute data. And I have a very simple first broker login flow (both set as alternatives):
Create User If Unique
Automatically Set Existing User
(see here: Server Administration Guide)