Conflicting data returned for /users/id and /users endpoints when user is temporarily locked

[tsaarni]

Describe the bug

The endpoints /users/id and /users return different results for the enabled field for the same user when the user is temporarily locked.

Version

16.0.0, 15.0.1

Expected behavior

Both the endpoints should return the same data for the same user.

Actual behavior

The user details via the /users?username=user endpoint wrongly returns enabled: true

How to Reproduce?

1. Enabled brute force detection
2. Create user
3. Repeatedly login with user with wrong password till it gets locked

Get the user details via the /users?username=user endpoint. Wrongly returns enabled: true

$ curl -k -X GET -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json"     $KC_URL/auth/admin/realms/master/users?username=user

[
  {
    "id": "21daeda5-86bc-406d-a687-fa4231bc6b54",
    "createdTimestamp": 1631277330288,
    "username": "user",
    "enabled": true,
    "totp": false,
    "emailVerified": false,
    "disableableCredentialTypes": [],
    "requiredActions": [],
    "notBefore": 0,
    "access": {
      "manageGroupMembership": true,
      "view": true,
      "mapRoles": true,
      "impersonate": true,
      "manage": true
    }
  }
]

Get the user details via the /users/id endpoint. Correctly returns enabled: false

$ curl -k -X GET -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json"     $KC_URL/auth/admin/realms/master/users/21daeda5-86bc-406d-a687-fa4231bc6b54

{
  "id": "21daeda5-86bc-406d-a687-fa4231bc6b54",
  "createdTimestamp": 1631277330288,
  "username": "user",
  "enabled": false,
  "totp": false,
  "emailVerified": false,
  "disableableCredentialTypes": [],
  "requiredActions": [],
  "notBefore": 0,
  "access": {
    "manageGroupMembership": true,
    "view": true,
    "mapRoles": true,
    "impersonate": true,
    "manage": true
  }
}

Anything else?

This issue was migrated from https://issues.redhat.com/browse/KEYCLOAK-19273. It was originally created 2021/09/10 by @bhorkarg.

[tsaarni]

Closing as not planned.
#8432 (comment)