User with username [JBoss] already exists, but is not linked to provider [RedHat Active Directory]
Issue
-
When changed "Username LDAP attribute" from cn to userPrincipalName in LDAP of User Federation. For example, cn is 'jboss' while userPrincipalName is jboss@redhat.com.
When I enable Kerberos integration with LDAP, user ID is retrieved as 'jboss' which does not match with jboss@redhat.com and cause the account cannot be login by Kerberos. -
When enabled "Allow Kerberos authentication" within LDAP user federation provider encountering below error logs.
07:06:15,301 DEBUG [org.keycloak.storage.ldap.LDAPStorageProvider] (default task-3) Kerberos authenticated user [JBoss] found in Keycloak storage
07:06:15,301 WARN [org.keycloak.storage.ldap.LDAPStorageProvider] (default task-3) User with username [JBoss] already exists, but is not linked to provider [RedHat Active Directory]
07:06:15,301 WARN [org.keycloak.storage.ldap.LDAPStorageProvider] (default task-3) Kerberos/SPNEGO authentication succeeded with username [JBoss], but couldn't find or create user with federation provider [RedHat Active Directory]
07:06:15,301 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (default task-3) authenticator FAILED: auth-spnego
Environment
- Red Hat Single Sign-On (RH-SSO)
- 7.x
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.