Hi Keycloak discourse group,
My team and I are using Keycloak at our company for quite some time now. Recently, we have noticed that there are some clean-ups that need to be done.
We have some identity providers that are no longer used. There are many users that are linked to these identity providers as well. We would like to delete both the identity providers and the users linked to them preferably using the kcadm.sh. Deleting the identity providers using the kcadm is trivial:
kcadm.sh delete identity-provider/instances/${identity_provider_id} -r ${realm}
The issue comes with identifying the users linked to those obsolete identity providers. In theory, we could get all users and with jq filter only those, that have a matching identity provider like so:
kcadm.sh get users -r ${realm}
However, this request gives us an array with information about each user like: id, createdTimestamp, enabled, totp, emailVerified and so on BUT without federatedIdentities, which contains the identity providers. Interestingly, when you execute a get request about a specific user by id:
kcadm.sh get users/${userid} -r ${realm}
the response contains also information about the federatedIdentities. I have noticed that there is a similar issue on here How to include identity provider links in the export of "get users" Admin CLI command unfortunately without any answer.
With this approach, we should extract all users ids’ and execute a get request for each id, in order to get the identity provider links for each user, which would be very slow for our relatively big database. We have also tried find the users linked to the identity providers by querying the identity providers with kcadm but without any success.
My question would be: Is there any better approach to find all users linked to our obsolete identity providers? We would prefer a kcadm.sh solution but other approaches are welcome as well. We would be very grateful for any help/hint/idea 