Creating or synchronizing a new user prompts that the user already exists. How to handle this?

Introduction to Background

To ensure platform security, new local users created or new IDP users synchronized on the old version platform cannot have the same name as deleted users (including local users and IDP users) on the platform. Therefore, when creating a local user, if the username is the same as the deleted user on the platform, the user cannot be created. When the user in the IDP docked to the platform has the same name as the deleted user on the platform, the same-named user cannot be synchronized to the platform.

Therefore, after the platform is upgraded to the current version, when creating or synchronizing new users on the platform, if the new user name is the same as the deleted user on the platform before the upgrade, the user cannot be created or synchronized.

Note: Starting from the current version, after deleting a user from the platform, it is allowed to create or synchronize a user with the same name.

Solution

Clean up the information of deleted users on the platform by manually executing scripts.

• Clean up deleted IDP users

  Execute the following script on any control node of the global cluster:

  kubectl delete users -l 'auth.cpaas.io/user.connector_id=<IDP Name>,auth.cpaas.io/user.state=deleted'

  Example:

  kubectl delete users -l 'auth.cpaas.io/user.connector_id=github,auth.cpaas.io/user.state=deleted'

• Clean up deleted local users

  Execute script 1 and script 2 in sequence on any control node of the global cluster.

  Script 1: Clean up user passwords.

  kubectl get users  -l 'auth.cpaas.io/user.connector_id=local,auth.cpaas.io/user.state=deleted' | awk '{print $1}' | xargs  kubectl delete  password -n cpaas-system

  Script 2: Clean up users.

  kubectl delete users  -l 'auth.cpaas.io/user.connector_id=local,auth.cpaas.io/user.state=deleted'