Scenario #9038: A New Subject with a New Uuid Is Created Despite a Deactivated Subject with the Same Name

UseCase Synchronize New Subject Reusing Deactivated Name => SubjectSync: sync-alicia (successor)

Keycloak enforces unique usernames only among existing users, so a name freed by a removed (here: deactivated) subject can be claimed by a completely new user with a new UUID. Synchronizing that new user creates a new subject (201 Created) despite the deactivated subject still carrying the same name, because name-uniqueness only applies to active subjects. The deactivated subject remains deactivated and untouched.

Properties

Required

• SubjectSync: sync-alice - deactivated from 9035: A Global Admin Can Deactivate a Removed Subject

Given

name	value
newSubjectUuid	238a0005-0000-0000-0000-000000000005
subjectName	sync-alicia
subjectType	USER
deactivatedSubjectUuid	238a0001-0000-0000-0000-000000000001

Synchronize the new subject reusing the deactivated subject’s name via PUT

HTTP PUT "/api/rbac/subjects/238a0005-0000-0000-0000-000000000005" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<hsh-alex_superuser>"` \
  `# }` \
  -H 'Content-Type: application/json' \
  --data-binary @- <<EOF
{
  "name" : "sync-alicia",
  "type" : "USER"
}
EOF
=> status: 201 CREATED 238a0005-0000-0000-0000-000000000005

The reused name refers to exactly one active subject

HTTP GET "/api/rbac/subjects?name=sync-alicia" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<hsh-alex_superuser>"` \
  `# }`
=> status: 200 OK 
[ {
  "uuid" : "238a0005-0000-0000-0000-000000000005",
  "name" : "sync-alicia",
  "type" : "USER"
} ]

The deactivated subject with the same name remains deactivated

HTTP GET "/api/rbac/subjects/238a0001-0000-0000-0000-000000000001" // SubjectSync: sync-alice \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<hsh-alex_superuser>"` \
  `# }`
=> status: 404 NOT_FOUND 

---

generated on 2026-07-17 01:44:28 for branch