Switch user between LDAP and IAM database results in 'email already exists'

Products

• CA Cloud Test Mobile
• CA Application Test

Issue/Introduction

Switching userid between the LDAP and the Identity Access Manager (IAM) embedded database results in 'email already exists'.

The following scenario for a particular userid resulted in an error (email already exists) when trying to create the user: 
1) No LDAP integration. The user was created with email in IAM. There was no problem logging in with this user.
2) The user was deleted in IAM.
3) LDAP integration was configured. No problem logging in with the same userid that exists in LDAP.
4) LDAP integration was disabled. As expected, it is no longer possible to login with the userid.
5) Now when trying to create the userid in IAM, and clicking save, there is an error: email already exists

How can the LDAP user email be cleared such that the internal IAM user can be created.

Environment

Release : 10.7

Component : CA Service Virtualization

Resolution

The user details, including email, are stored in the USER_ENTITY table. If you configure an external database for IAM like SQLServer you can use SQL Server Management Studio to inspect the table.

If you are using the embedded IAM database, this data is stored in the IdentityAccessManager/data directory. For the DevTest 10.7.2 SP3 version and later versions, the data is stored in the IdentityAccessManager/data directory.

On Linux you could use grep to verify if the email is stored in the file keycloak.mv.db somewhere. Note that this is not a file that can be edited.

You can simply reset the embedded database but you will lose any previously configured users, groups, user federations etc.

To reset the embedded database for the DevTest 10.7.2 SP2 version and earlier versions:
1) Stop the IdentityAccessManagerService
2) Rename the IdentityAccessManager/data directory
3) Restart the IdentityAccessManagerService

To reset the embedded dababase for the DevTest 10.7.2 SP3 version and later versions:
1) Stop the IdentityAccessManagerService 
2) Rename the IdentityAccessManager/data directory (if there is a process that still has a file open, you may also need to stop the java process that runs kc)
3) Restart the IdentityAccessManagerService

This should recreate the data folder with subdirectories and files and include the standard default users like admin.