Scenario #9039: A Deactivated Subject Is Reactivated by the Next Synchronization with the Same Uuid

When a subject reappears in Keycloak, e.g. via a replayed event or a re-created user with the same UUID, the sync program simply synchronizes it again. Because the earlier removal was just a deactivation, the UUID-keyed upsert reactivates the retained subject: it keeps its UUID, becomes visible again, and the upsert reports an update (200 OK), not a creation.

Properties

Required

• SubjectSync: sync-alice - deactivated from 9035: A Global Admin Can Deactivate a Removed Subject

Given

name	value
subjectUuid	238a0001-0000-0000-0000-000000000001
subjectName	sync-alice
subjectType	USER

Re-synchronize the deactivated subject via PUT with the same UUID

HTTP PUT "/api/rbac/subjects/238a0001-0000-0000-0000-000000000001" // SubjectSync: sync-alice \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<hsh-alex_superuser>"` \
  `# }` \
  -H 'Content-Type: application/json' \
  --data-binary @- <<EOF
{
  "name" : "sync-alice",
  "type" : "USER"
}
EOF
=> status: 200 OK 

The reactivated subject is visible again

HTTP GET "/api/rbac/subjects/238a0001-0000-0000-0000-000000000001" // SubjectSync: sync-alice \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<hsh-alex_superuser>"` \
  `# }`
=> status: 200 OK 
{
  "uuid" : "238a0001-0000-0000-0000-000000000001", // SubjectSync: sync-alice
  "name" : "sync-alice",
  "type" : "USER"
}

---

generated on 2026-07-17 01:44:28 for branch