Unexpected error when authenticating with identity provider: duplicate key value violates unique constraint "constraint_40"

Applies to: All versions through 6.x with Single Sign-On (SSO) (such as Okta, WebSSO, etc.)

Issue:

An individual user attempts to log in and sees “Unexpected error when authenticating with Identity provider”: Clearing the browser cache and cookies or switching to a different browser does not resolve the error. Search for exception in the Keycloak logs using the following command:

kubectl logs -n domino-platform keycloakpodname --timestamps | grep -i exception

The logs return an entry similar to this:

2023-04-25T13:06:37.247217108Z ERROR [org.hibernate.engine.jdbc.spi.SqlExceptionHelper] (default task-3858) ERROR: duplicate key value violates unique constraint "constraint_40"
2023-04-25T13:06:37.247219975Z Detail: Key (identity_provider, user_id)=(domino-credentials, 39a47782-8c3e-46d1-9091-a7105ff795ea) already exists.

Root Cause:

Domino requests that Keycloak verify authentication against the SSO provider. Based on the SSO response, Keycloak attempts to create a new user record for the combination of Provider Username and email address. Keycloak creates a new record when it detects a change in the casing of the username, email address, or another attribute. For example, if the SSO Security Assertion Markup Language (SAML) response returns an email address with an uppercase letter, Keycloak treats it as a new record. The duplicate key violation occurs because the username or Provider User ID already exists in the database.

Resolution:

In the Keycloak Admin Console, open the individual user record.
On the Identity Provider Links tab, select Remove.
Have the user re-attempt login through the Domino UI.

Notes

To understand why Keycloak is treating the user as a new record, review the SAML requests and responses exchanged between Keycloak and the SSO provider.

​Issue:

​Root Cause:

​Resolution:

​Notes

Issue:

Root Cause:

Resolution:

Notes