topic Re: Alfresco ACS 6.1.2ga SSO Authentification with keycloak duplicating users in Alfresco Forum

Alfresco ACS 6.1.2ga SSO Authentification with keycloak duplicating users

pedrohernandez — Wed, 20 Mar 2019 15:57:32 GMT

Hello Everybody and thanks in advance for your help.We are implementing authentification with keycloak version keycloak: 4.8.3. Final, and we're having the issue that when logging in with any user, it enters in a loop while logging and it creates several duplicate users in alfresco, we wanted to kno

Re: Alfresco ACS 6.1.2ga SSO Authentification with keycloak duplicating users

afaust — Wed, 20 Mar 2019 20:41:00 GMT

Interesting... it shouldn't actually be possible to create users with exactly the same name due to uniqueness constraints on the user name. I would bet this may not be a known issue (did you search JIRA for it?), since 6.1.2 GA is quite a new release and not a lot of people are using Alfresco with Keycloak yet, especially since Share does not support it for single sign-on purposes.

Re: Alfresco ACS 6.1.2ga SSO Authentification with keycloak duplicating users

pedrohernandez — Thu, 21 Mar 2019 13:04:49 GMT

Axel, Thank you for your time.

I was looking in JIRA and couldn't find information, but first time using JIRA so I may have miss something. Some more information about the issue is that the logging is being made through ADF components, and when I logging it throw this exceptions on the logs:

INFO [security.person.PersonServiceImpl] [http-nio-8080-exec-9] Splitting 1 duplicate person objects. then again:

INFO [security.person.PersonServiceImpl] [http-nio-8080-exec-5] Splitting 2 duplicate person objects.

then:

[36malfresco_1 | [0m 2019-03-20 15:33:32,947 INFO [security.person.PersonServiceImpl] [http-nio-8080-exec-2] Splitting 2 duplicate person objects.
[36malfresco_1 | [0m 2019-03-20 15:33:32,974 INFO [security.person.PersonServiceImpl] [http-nio-8080-exec-9] Splitting 2 duplicate person objects.
[36malfresco_1 | [0m 2019-03-20 15:33:33,001 INFO [security.person.PersonServiceImpl] [http-nio-8080-exec-1] Splitting 2 duplicate person objects.

INFO [security.person.PersonServiceImpl] [http-nio-8080-exec-7] Splitting 2 duplicate person objects.
INFO [security.person.PersonServiceImpl] [http-nio-8080-exec-7] New person object: pedrodc7c953d-5366-482e-8ca6-ab0ca533f9d5
INFO [security.person.PersonServiceImpl] [http-nio-8080-exec-7] New person object: pedroc3454366-51e9-47f3-b6b9-88e5e8e75b2e
[security.person.PersonServiceImpl] [http-nio-8080-exec-7] Split 2 duplicate person objects.

Re: Alfresco ACS 6.1.2ga SSO Authentification with keycloak duplicating users

afaust — Fri, 22 Mar 2019 14:58:05 GMT

Ahh... that split handling is a very specific segment of code where Alfresco internally sets a special flag to allow duplicate user IDs for the transaction in which they are created. Come to look at it, this specific code has been in Alfresco for a long time. It is triggered only when more than one person with the identical name already exists, so it is only responsible for any subsequent duplication but not for the very first one. Essentially, it can split person objects in every read-write transaction where a specific lookup API is called/invoked in Java.

Re: Alfresco ACS 6.1.2ga SSO Authentification with keycloak duplicating users

pedrohernandez — Fri, 22 Mar 2019 16:00:06 GMT

So that means that the issue is currently happening during the login process that is making several calls to create the same user?, if so. maybe to correctly test this is to use https://github.com/Alfresco/alfresco-content-app, that to my knowledge is tested with ACS 6.1 and integration with keycloak was working fine?, if this test have the same results duplicating the users then maybe I can create an issue in JIRA.

Or maybe should I take another approach?, what do you think?

Thanks for your time.

Regards.

Re: Alfresco ACS 6.1.2ga SSO Authentification with keycloak duplicating users

damien_rider — Mon, 23 Sep 2019 05:06:58 GMT

Hi @pedrohernandez and @afaust, I'm also having this exact problem. I'm seeing the same things in the logs. Was there any resolution on this problem?

Thanks,
Damien.

Re: Alfresco ACS 6.1.2ga SSO Authentification with keycloak duplicating users

afaust — Mon, 23 Sep 2019 07:12:11 GMT

After the original post, I have now been using Keycloak at a customer too. I have never been able to reproduce the core issue, e.g. what caused the first duplication. Essentially, the simplest way to fix the issue "should" be to delete all the duplicated person objects, and then the logic in PersonService which creates further duplicates should not be triggered again.