InseeFr / InseeFr/Keycloak-FranceConnect

[BUG] Unable to create multiple FranceConnect IdPs in the same realm when using custom aliases

Open
#168 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
106
Forks
39
Avg merge
3d 12h
Merged PRs (30d)
3

Description

**Describe the bug**
It is not possible to create multiple FranceConnect identity providers within the same Keycloak realm when using custom aliases.

When creating a second FranceConnect IdP, Keycloak throws the following error:

`org.keycloak.models.ModelException: Identity provider mapper name must be unique per identity provider`

After investigation, it seems that the mappers are always created with:

`"identityProviderAlias": "franceconnect-particulier"`

regardless of the alias configured during IdP creation.

As a consequence:

creating a FranceConnect IdP with the default alias works
changing the alias prevents the mappers from being correctly attached to the created IdP
creating a second FranceConnect IdP causes mapper conflicts
The README indicates that the alias can be customized and that mappers are automatically created, but this behavior does not seem to work correctly.

Possible related source code:

https://github.com/InseeFr/Keycloak-FranceConnect/blob/master/src/main/java/fr/insee/keycloak/providers/franceconnect/FranceConnectIdentityProviderFactory.java

**To Reproduce**

Steps to reproduce the behavior:

1. Create a FranceConnect identity provider in a realm
2. Change the default alias to a custom alias
3. Save the IdP
4. Create a second FranceConnect identity provider in the same realm
5. See the following error:

`org.keycloak.models.ModelException: Identity provider mapper name must be unique per identity provider`

Relevant stack trace:

`ERROR [org.keycloak.services.error.KeycloakErrorHandler] (executor-thread-1) Uncaught server error: org.keycloak.models.ModelException: Identity provider mapper name must be unique per identity provider
at org.keycloak.models.jpa.JpaIdentityProviderStorageProvider.checkUniqueMapperNamePerIdentityProvider(JpaIdentityProviderStorageProvider.java:606)
at org.keycloak.models.jpa.JpaIdentityProviderStorageProvider.createMapper(JpaIdentityProviderStorageProvider.java:378)
at org.keycloak.models.cache.infinispan.idp.InfinispanIdentityProviderStorageProvider.createMapper(InfinispanIdentityProviderStorageProvider.java:322)
at org.keycloak.models.cache.infinispan.RealmAdapter.addIdentityProviderMapper(RealmAdapter.java:1265)
at java.base/java.lang.Iterable.forEach(Iterable.java:75)
at fr.insee.keycloak.providers.common.AbstractBaseProviderConfig.validate(AbstractBaseProviderConfig.java:88)`

**Expected behavior**
Mapper creation should use the actual IdP alias configured by the user
Multiple FranceConnect IdPs should be supported within the same realm
Changing the IdP alias should not break mapper association

**Screenshots**
If needed, I can provide screenshots of the IdP configuration and generated mappers.

**Additional context**
- Keycloak Version: [26.5.3]
- Version [7.7.0]

Contributor guide

Open the contributing guide

Research direction

Start with src/main/java/fr/insee/keycloak/providers/franceconnect/FranceConnectIdentityProviderFactory.java and trace how the configured alias reaches mapper creation, using the stack trace and AbstractBaseProviderConfig.validate as context. Done means mapper creation uses the user-configured alias and multiple FranceConnect identity providers can coexist in one realm without mapper conflicts.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.