Issue #3624189 by daniel.pernold: User lookup by username is a substring...

Issue #3624189 by daniel.pernold: User lookup by username is a substring search, so the wrong account gets updated or deleted

insertUser(), updateUser() and deleteUser() looked the account up with GET /users?username= and no exact flag, so Keycloak searched the name as a substring, and $search_response[0] was whichever matching account sorted first. A user whose login name occurs inside another account's name was therefore handled as that other account: deleteUser() could delete it, insertUser() could decide the user already existed, and updateUser() wrote onto it, where a mail address conflict usually refused the whole update and the intended account silently kept its old data.

Pass exact=true, so the lookup returns the one account whose username is the one asked for.

Closes #3624189

Merge request reports

Loading
Loading