Preserve User Profiles When Cloning to a Different Identity Provider
Last modified by Eleni Cojocariu on 2026/08/03 09:28
Steps
Instead of copying authentication settings when the target instance must use a different identity provider (or client configuration) than the source, preserve user profiles:
- Before cloning, on the target instance, export as pages in xar format all user profiles linked to external identities.
- Follow Clone an XWiki Instance to back up and restore the database and permanent directory. Skip any authentication setting stored in xwiki.properties when copying files to the target instance.
- If authentication settings are stored on the wiki instead, for example through the Administration, or on a configuration page as the OIDC authenticator supports, restore the target instance's own values after the database restore. Wiki-stored settings take priority over xwiki.properties when both exist.
- Reconnect the cloned user profiles to the target instance's identity provider, using one of:
- Import back the profile pages you exported before cloning, restoring the target's own identity data.
- Update the identity data of the cloned profiles directly in the database instead. For the OIDC authenticator, this means the issuer (one value, shared by every profile) and, for each profile, the subject (one value per user, which may differ between the source and target instances depending on the OIDC setup).
- Log in on the target instance and check that each user is matched to their existing profile, not a new one. If login doesn't work at all, use the superadmin account as a fallback.
FAQ
Why can't I just copy the authentication settings like everything else?
The target instance would end up pointing at the wrong identity provider, and existing user profiles would no longer match. See XWiki Instance cloning for details.
What happens if I skip this and clone the database as usual?
Users get a new profile when they log in on the target instance, because their identity data (issuer and subject, for OIDC) no longer matches any profile already stored there.
Should I export/import the profiles, or update the database directly?
Both give the same result. Export/import only uses the wiki's own tools. Updating the database directly skips the re-import, but needs direct database access.
