[Authentication] Deleted user can be recreated? User already exists error with LDAP?

[anichucai]

Hi all,

I saw this in your documentation:

Deleting a user results in permanently blocking them from phoenix. The action cannot be undone and the user cannot be reactivated with the same email or username. Please be careful when deleting users.

Is this still valid? Locally I tested deleting my user (created with OIDC) and I could log in (my user was recreated) again without problems. I prefer it this way though.

The image I used is: arizephoenix/phoenix:11.18.0

I needed this because if I updated my PHOENIX_OAUTH2_<IDP>_CLIENT_ID I get an User already exists error.

Thanks in advance!

[dosubot[bot]]

Hi @anichucai! I'm Dosu and I’m helping the phoenix team.

The documentation about deleted users being permanently blocked and unrecoverable is outdated for OIDC/OAuth2 users. In the current Phoenix backend, deleting a user removes their record from the database, and there is no logic to block or reserve their email or username. If allow_sign_up is enabled, a deleted OIDC user can log in again and be recreated with the same identifiers, which matches what you observed locally.

The "User already exists" error happens if a user with the same email or username is still present in the database—this can occur if the user wasn't deleted properly or if there's a conflict after changing PHOENIX_OAUTH2_<IDP>_CLIENT_ID. The combination of client ID and user ID is used to uniquely identify OIDC users, so changing the client ID can lead to conflicts if the same email exists under a different client ID.

There is no evidence of a blocklist or permanent reservation of deleted user identifiers for OIDC/OAuth2 users in the codebase, so the behavior you prefer is actually how Phoenix works today. The PHOENIX_OAUTH2_<IDP>_ALLOW_SIGN_UP variable controls whether new users can be created automatically upon login with an external identity provider.
Source: codebase

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}    

[axiomofjoy]

Thanks @anichucai. I believe the docs are incorrect here. You should be able to recreate users with a deleted email.

[anichucai]

Thanks for your answer!