Hello GoodData Team, Now that we have successfully set up our development environment, we are ready to remove our Dev OIDC (Keycloak) configuration from the GoodData production environment and replace it with the production instance of Keycloak. However, I have concerns regarding the impact on our PAC tokens. Specifically, I am worried that removing the development Keycloak instance might orphan users and cause issues with token functionality. Could you please advise on the best process to follow to ensure a smooth transition and prevent any loss of access to the GoodData production environment?

Hello Hayley, What exactly are you referring to as PAC tokens here? Is this the Personal Access Token on GoodData's side? From our perspective, switching to a different OIDC provider, even if its just switching to different keycloak instance, comes down to simply updating your org setting and mapping the existing users to a new authId (if its different). As long as you won’t remove users from existing user groups while updating them it won’t affect API tokens within GoodData.

Thanks Joseph , we have managed to successfully switch our OIDC environments.