How to use two providers with same username in a realm/client in keycloak

I have keycloak instance (version 16) with one realm and two different clients.

The first client works with Open ID Connect Identity provider. It also works with public Access Type and with SSO and 2FA. The second client works with a Custom module added from User Federation where 2FA is not possible to be used because the calls for authentication are mainly programmatically. Also, this client works with confidential Access Type.

The problem is that each client has a different external database with users, but the usernames in these databases are not unique.

And if I try to log in with the second client it works but after that, if I try to log in with the first client I can't, and vice versa. (in both clients username "[email protected]" is used)

The error message in this case is:

User with username [email protected] already exists. How do you want to continue?
    “Review profile”
    “Add to existing account”

Is it possible for these two clients to work both properly at the same time, when I do not have unique usernames and how should I configure it? (I find that is possible to have same email addresses but I can't find anything for usernames) Maybe some kind of force authentication will be OK, and when the user "[email protected]" is already logged with the first client and I try to log in with the second, the session from the first one to be deleted and vice versa.

Solution

Depending on how your IDPs are configured you can try the following:

go to your realm
then to the IDP configuration in question
switch to Mappers
Click on Create
As a mapper type select Username teamplate Importer
in the template field and something that will make the username unique for example ${CLAIM.preferred_username}_<The Name of the IDP>

For example, if a username named 'user' logins from both 'IDP1' and 'IDP2' it will be imported into the Keycloak DB as 'user_IDP1' and 'user_IDP2', respectively.