# Bug OP-13355 - When disabling the default `admin` user, after an update two `admin` users exists in the database.

Project: OpenProject
Status: closed
URL: https://community.openproject.org/work_packages/OP-13355

## Open points

_No work packages_

## Details

| Attribute | Value |
| --- | --- |
| Date |  |
| Priority | Medium |
| Module |  |
| Target versions | 13.1.0 |
| Observed in versions |  |
| Sprint | 13.1.0 |
| Backlog bucket |  |
| Bug found in version (deprecated) |  |
| Found in mobile app version |  |
| Follow-up feedback e-mail |  |
| Requires doc change | No |
| Accessibility | No |
| Pull preview |  |
| List |  |
| Labels |  |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable |  |
| Product manager |  |
| Developers |  |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Planning

| Attribute | Value |
| --- | --- |
| Relevance |  |

## Costs

| Attribute | Value |
| --- | --- |
| Votes |  |
| Work |  |
| Labor costs |  |

## Description

### Steps to reproduce

1.  Install OpenProject and seed the database.
2.  Add admin flag to all users that need admin permissions.
3.  Remove admin flag for the default `admin` user.
4.  Lock the default `admin` user as it is not needed anymore.
5.  Wait for an OpenProject update.
6.  Run database migrations again as it is done by `openproject reconfigure`.

### What is the buggy behavior?

After step 6, there are two distinct `admin` users present in OpenProject. The following entries are returned by the REST API

New `admin` user:

``` python
{
  '_type': 'User',
  'id': 1164,
  'name': 'OpenProject Admin',
  'createdAt': '2023-09-27T01:52:40Z',
  'updatedAt': '2023-09-27T01:52:40Z',
  'login': 'admin',
  'admin': True,
  'firstName': 'OpenProject',
  'lastName': 'Admin',
  'email': 'admin@example.net',
  'avatar': '',
  'status': 'active',
  'identityUrl': None,
  'language': 'de',
  '_links': # ...
 }
```

Old `admin` user

``` python
{
  '_type': 'User',
  'id': 6,
  'name': 'OpenProject Admin',
  'createdAt': '2023-09-13T16:22:32Z',
  'updatedAt': '2023-09-14T06:30:02Z',
  'login': 'admin',
  'admin': False,
  'firstName': 'OpenProject',
  'lastName': 'Admin',
  'email': 'admin@example.net',
  'avatar': '',
  'status': 'locked',
  'identityUrl': None,
  'language': 'de',
  '_links': # ...
}
```

When trying to modify the latter user via the REST API, the following error is returned (status code 422)

``` json
{
  "_type": "Error",
  "errorIdentifier": "urn:openproject-org:api:v3:errors:MultipleErrors",
  "message": "Einschr\xc3\xa4nkungen f\xc3\xbcr mehrere Felder wurden verletzt.",
  "_embedded":
  {
    "errors":
    [
      {
        "_type": "Error",
        "errorIdentifier": "urn:openproject-org:api:v3:errors:PropertyConstraintViolation",
        "message": "Benutzername ist bereits vergeben.",
        "_embedded":
        {
          "details":
          {
            "attribute": "login"
          }
        }
      },
      {
        "_type": "Error",
        "errorIdentifier": "urn:openproject-org:api:v3:errors:PropertyConstraintViolation",
        "message": "E-Mail ist bereits vergeben.",
        "_embedded":
        {
          "details":
          {
            "attribute": "email"
          }
        }
      }
    ]
  }
}
```

### What is the expected behavior?

It should not be possible to add two distinct users with the same user ID or the same email address.

### **Logs**

N/A

### Screenshots and other files

N/A

### Environment information

**OpenProject installation type**

- [ ] Hosted cloud edition
- [x] Packaged installation
    - Debian 12
- [ ] Docker All-in-one container
- [ ] Docker-compose installation
- [ ] Other (please specify)

**OpenProject version**

*OpenProject Enterprise Edition 13.0.4*

*We discovered the issue during an automatic upgrade from 13.0.3 to 13.0.4. It might happen since 13.0.0. We didn't observe such an issue with OpenProject 12.*

**Browser**

N/A

**Language**

German