User deletion

[Unicard Support]

Hi there.

I work as a data protection adviser on behalf of Unicard Ltd. (UK) We are a software development company and have recently integrated Key cloak into a number of new systems. 

I am trying to complete some documentation for a new clients data protection agreement. We need to understand the process when a user is deleted from Key cloak and what happens to the user data what (If anything) and how it is destroyed / deleted exactly.

Are you able to offer me some insight on this subject?

Regards

Ben

[Tobias Häfner]

Hi Ben,

as far as I know, there is no automatic user deletion in Keycloak. You have to implement it yourself or run some cyclic database scripts to delete the users.

Best regards

Tobias

[Thomas Darimont]

Hello,

In some of our projects we added support for deleting users after some period of inactivity (2 years). In order to do this, you need to track the time of last activity, e.g. login timestamp with a custom extension.

Then query the Keycloak database for users that have not signed-in within the a period and use the Keycloak admin api to delete the user. Using deleting a user with the keycloak api will remove the user, their attributes, and their credentials.

As an additional note, you can also allow users to delete their own account: https://www.keycloak.org/docs/latest/server_admin/index.html#proc-allow-user-to-delete-account_server_administration_guide

Cheers,

Thomas

[Tobias Häfner]

Here you can see how something like this can look. Unfortunately, you have to write it yourself.

Best regards

Tobias

[Unicard Support]

Hi All,

Thank you for your replies however these responses don't quite answer my question. I need to understand how the data is destroyed within the keycloak data base and on the disk itself?

For example, is the deleted data overwritten with 0's upon deletion or after a given time frame?

Many thanks

Ben Hepworth

[Tobias Häfner]

Hello,

I think that depends on the database you use. It will create a delete statment on the database. What the database does after that depends on the db.

With MySQL it will write Zeros on hard disk.

Best regards

Tobias

[Unicard Support]

Thank you Tobias. 

This was helpful. 

Thank you all for your responses.

Regards

Unicard Support