InseeFr / InseeFr/Keycloak-FranceConnect
[BUG] Unable to create multiple FranceConnect IdPs in the same realm when using custom aliases
- Dominant language
- Java
- Stars
- 106
- Forks
- 39
- Avg merge
- 3d 12h
- Merged PRs (30d)
- 3
Description
**Describe the bug**
It is not possible to create multiple FranceConnect identity providers within the same Keycloak realm when using custom aliases.
When creating a second FranceConnect IdP, Keycloak throws the following error:
`org.keycloak.models.ModelException: Identity provider mapper name must be unique per identity provider`
After investigation, it seems that the mappers are always created with:
`"identityProviderAlias": "franceconnect-particulier"`
regardless of the alias configured during IdP creation.
As a consequence:
creating a FranceConnect IdP with the default alias works
changing the alias prevents the mappers from being correctly attached to the created IdP
creating a second FranceConnect IdP causes mapper conflicts
The README indicates that the alias can be customized and that mappers are automatically created, but this behavior does not seem to work correctly.
Possible related source code:
https://github.com/InseeFr/Keycloak-FranceConnect/blob/master/src/main/java/fr/insee/keycloak/providers/franceconnect/FranceConnectIdentityProviderFactory.java
**To Reproduce**
Steps to reproduce the behavior:
1. Create a FranceConnect identity provider in a realm
2. Change the default alias to a custom alias
3. Save the IdP
4. Create a second FranceConnect identity provider in the same realm
5. See the following error:
`org.keycloak.models.ModelException: Identity provider mapper name must be unique per identity provider`
Relevant stack trace:
`ERROR [org.keycloak.services.error.KeycloakErrorHandler] (executor-thread-1) Uncaught server error: org.keycloak.models.ModelException: Identity provider mapper name must be unique per identity provider
at org.keycloak.models.jpa.JpaIdentityProviderStorageProvider.checkUniqueMapperNamePerIdentityProvider(JpaIdentityProviderStorageProvider.java:606)
at org.keycloak.models.jpa.JpaIdentityProviderStorageProvider.createMapper(JpaIdentityProviderStorageProvider.java:378)
at org.keycloak.models.cache.infinispan.idp.InfinispanIdentityProviderStorageProvider.createMapper(InfinispanIdentityProviderStorageProvider.java:322)
at org.keycloak.models.cache.infinispan.RealmAdapter.addIdentityProviderMapper(RealmAdapter.java:1265)
at java.base/java.lang.Iterable.forEach(Iterable.java:75)
at fr.insee.keycloak.providers.common.AbstractBaseProviderConfig.validate(AbstractBaseProviderConfig.java:88)`
**Expected behavior**
Mapper creation should use the actual IdP alias configured by the user
Multiple FranceConnect IdPs should be supported within the same realm
Changing the IdP alias should not break mapper association
**Screenshots**
If needed, I can provide screenshots of the IdP configuration and generated mappers.
**Additional context**
- Keycloak Version: [26.5.3]
- Version [7.7.0]
Contributor guide
Research direction
Start with src/main/java/fr/insee/keycloak/providers/franceconnect/FranceConnectIdentityProviderFactory.java and trace how the configured alias reaches mapper creation, using the stack trace and AbstractBaseProviderConfig.validate as context. Done means mapper creation uses the user-configured alias and multiple FranceConnect identity providers can coexist in one realm without mapper conflicts.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 72/100