-
Notifications
You must be signed in to change notification settings - Fork 7.9k
Description
Describe the bug
When the keycloak docker container restarts, it attempts to create the initial admin account based on the "KEYCLOAK_ADMIN" and "KEYCLOAK_ADMIN_PASSWORD" environment variable.
If the initial admin account was previously deleted and there is at least 1 user already in the master realm, the admin account will not be recreated and give the following error:
ERROR [org.keycloak.services] (main) KC-SERVICES0010: Failed to add user 'user' to realm 'master': user with username exists
Version
18.0.0
Expected behavior
I would expect the same behavior as keycloak 16 and before where the admin user would simply be recreated if it was previously deleted.
Actual behavior
The admin acocunt which is supposed to be created with the environment variable does not get created.
How to Reproduce?
- Proceed with a regular launch of a keycloak docker container instance.
- Log in the master realm and create 1 user with realm admin role.
- Delete the admin account that was created at deployment using the "KEYCLOAK_ADMIN" environment variable.
- stop-start the container without wiping the DB.
- The error will be in the logs, the admin user will not be created.
Anything else?
We have a case figure where the initial admin account needs to be deleted and we are creating individual admin accounts in the master realm, this way each dev has an account in the master realm with an OTP.
Our security guidelines can't leave an admin account active without an OTP therefore the initial admin accounts needs to be delete once the deployement is over, recreated at a stop-start to execute start-up scripts then redeleted once the scripts are completed.