Workaround For Resolving Issues with LDAP Sync and User Management in IDE Services

Overview

In an on-premise deployment, when an external directory account’s attribute changes but some attribute remains the same, directory sync in IDE Services can fail due to a uniqueness conflict on email.

for example: duplicate key value violates unique constraint "TBE_USER_UNIQ_EMAIL"

This typically occurs because IDE Services still contains an older user record tied to the previous ser entry with the same attribute. The steps below describe how to remove the stale record so sync can recreate the user entry correctly.

Answer

Resolving LDAP Sync Failure

The directory sync failed because an account identifier changed in the external directory, which led to duplicate records in the IDE Services database. Follow these steps to resolve this issue:

1. 1. Identify the stale user entry

      • In the IDE Services Users page, find the user that still has the old username (for example, usernaem) but the correct email (user.name@example.org).
      • Open that user and copy their ID (UUID).

   2. Temporarily disable LDAP user import (but keep LDAP logins) In application.yaml (or Helm values), set:

      tbe:
        users:
          import:
            enabled: false
      

      • Leave tbe.auth.ldap.enabled: true as it is, so LDAP logins remain available..
      • Restart the IDE Services server so this change takes effect.
      • During this step, scheduled LDAP user/group synchronization is paused, so it is recommended to do it during a short maintenance window.

   3. Delete the stale user via REST API

      From an admin machine (using an Automation token with user‑management rights):

      curl -v -L -X DELETE "https://<ides_host>/api/v1/users/<USER_ID>" \
        -H "accept: */*" \
        -H "Authorization: Automation <token_value>"
      

      Replace:

      • <ides_host> with your IDE Services URL.
      • <USER_ID> with the UUID from step 1.
      • <token_value> with your Automation token.

      Expected result: HTTP 200 or 204, and the user no longer appears in the Users list.

   4. Re‑enable LDAP user import

      Restore import configuration, for example:

      tbe:
        users:
          import:
            enabled: true
      

      Then restart IDE Services again.

   5. Run a manual sync and verify

      • In the IDE Services Web UI, go to Users → Synchronize users (or wait for the next scheduled sync).
      • Confirm:
        • The sync completes without the TBE_USER_UNIQ_EMAIL error.
        • The user is present once, with the correct sAMAccountName and the same email address.

   Repeat these steps for other clearly identified mis‑synced LDAP users, but it is recommented to limit it to confirmed problematic accounts.