Deactivate Keycloak users when synchronizing

[felinira]

Summary

Whenever a keycloak full sync job is finished and it doesn't find a particular user anymore, the user mailbox is deactivated.

Motivation

Sometimes people leave the keycloak realm, because their account gets deleted, either by an administrator, or via keycloak self-service. When they can't log in anymore, deactivating the account properly makes it easy to find and delete their mailboxes, and stops the mail server from accepting new mails for these defunct mailboxes.

This is also useful for complying with data protection regulations, because it becomes much easier to sort the mailbox list by deactivated users, and then delete their mailbox.

Additional context

No response

[rtfm98]

Just my two cents: I would suggest to use a minimum threshold of times, a user couldn't be found in Keycloak. So that a malfunction of Keycloak or Mailcow won't deactivate multiple or even all accounts by fault.

[kvdb]

I was about to start deploying Keycloak integration with Mailcow, but then I noticed that the off-boarding flow described in this issue is not implemented yet.

It would be helpful to hear from one of the core developers whether this is considered desirable behavior for the future, or whether there are reasons not to implement automatic account disabling.

One related question: it seems app passwords are currently excluded from external IdP integration. Is that also a deliberate design choice, or simply something that may be added later?

I am asking for the same reason: ideally, app passwords would also be disabled automatically when a Keycloak user is deactivated.