From a43b65281d6f3631366b71858cad25676aaf635d Mon Sep 17 00:00:00 2001
From: Stefan Guilhen <sguilhen@redhat.com>
Date: Wed, 11 Dec 2024 09:37:53 -0300
Subject: [PATCH] Search user by id and fallback to username when needed -
 prevents performance issues when reading policies as users are always stored
 by id.

Closes #35796

Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
---
 .../policy/provider/user/UserPolicyProviderFactory.java      | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/user/UserPolicyProviderFactory.java b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/user/UserPolicyProviderFactory.java
index 3ddccce0f14..103587c568c 100644
--- a/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/user/UserPolicyProviderFactory.java
+++ b/authz/policy/common/src/main/java/org/keycloak/authorization/policy/provider/user/UserPolicyProviderFactory.java
@@ -166,10 +166,11 @@ public class UserPolicyProviderFactory implements PolicyProviderFactory<UserPoli
         KeycloakSession session = authorization.getKeycloakSession();
         RealmModel realm = authorization.getRealm();
         UserProvider userProvider = session.users();
-        UserModel user = userProvider.getUserByUsername(realm, userId);
+        UserModel user = userProvider.getUserById(realm, userId);
 
         if (user == null) {
-            user = userProvider.getUserById(realm, userId);
+            // fallback - userId is possibly a username
+            user = userProvider.getUserByUsername(realm, userId);
         }
 
         return user;