Importing user from LDAP to RH-SSO fails with error "email already exists"

Solution Verified - Updated -

Environment

  • Red Hat Single Sign-On (RH-SSO)
    • 7
  • Lightweight Directory Access Protocol (LDAP) or Active Directory Lightweight Directory Service (AD)

Issue

  • Could not able to import users

  • Exception thrown in the logs:

    2017-04-24 09:04:28,016 ERROR [org.keycloak.storage.ldap.LDAPStorageProviderFactory] (default task-2) Failed during import user from LDAP: org.keycloak.models.ModelDuplicateException: Can't import user 'user1' from LDAP because email 'abc@example.com' already exists in Keycloak. Existing user with this email is 'user0'
2017-04-24 09:04:28,028 ERROR [org.keycloak.storage.ldap.LDAPStorageProviderFactory] (default task-2) Failed during import user from LDAP: org.keycloak.models.ModelDuplicateException: Can't import user 'user2' from LDAP because email 'abc@example.com' already exists in Keycloak. Existing user with this email is 'user0'

Resolution

This error occurs when single e-mail id is mapped with multiple users.

You can make sure no 2 uses have the same email address, or use one of 2 workarounds:

  1. Delete e-mail mapper
    1. Login into RH-SSO console
    2. Select the appropriate realm
    3. Click on User Federation and Click on appropriate provider
    4. Go to Mappers tab, click on email attribute mapper and click on the delete symbol
      Email Mapper Deletion
  2. Turning on "Duplicate emails" in the Login tab
    1. Login into RH-SSO console
    2. Select the appropriate realm
    3. Go to Login tab and turn off Login with email settings. Then, Duplicate emails appears.
    4. Turn on Duplicate emails and save it.
      duplicate email

Root Cause

RH-SSO does not allow multiple user to have same email-id when Login with email is enabled, which is the default.

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments