> ## Documentation Index
> Fetch the complete documentation index at: https://docs.domino.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Unexpected error when authenticating with identity provider: duplicate key value violates unique constraint "constraint_40"

> Resolve the Keycloak "duplicate key value violates unique constraint constraint_40" SSO login error by removing and re-linking the affected user's Identity Provider record.

**Applies to:** All versions through 6.x with Single Sign-On (SSO) (such as Okta, WebSSO, etc.)

## **Issue:**

An individual user attempts to log in and sees "Unexpected error when authenticating with Identity provider":

Clearing the browser cache and cookies or switching to a different browser does not resolve the error. Search for `exception` in the Keycloak logs using the following command:

```
kubectl logs -n domino-platform keycloakpodname --timestamps | grep -i exception
```

The logs return an entry similar to this:

```
2023-04-25T13:06:37.247217108Z ERROR [org.hibernate.engine.jdbc.spi.SqlExceptionHelper] (default task-3858) ERROR: duplicate key value violates unique constraint "constraint_40"
2023-04-25T13:06:37.247219975Z Detail: Key (identity_provider, user_id)=(domino-credentials, 39a47782-8c3e-46d1-9091-a7105ff795ea) already exists.
```

## **Root Cause:**

Domino requests that Keycloak verify authentication against the SSO provider. Based on the SSO response, Keycloak attempts to create a new user record for the combination of **Provider Username** and email address.

Keycloak creates a new record when it detects a change in the casing of the username, email address, or another attribute. For example, if the SSO Security Assertion Markup Language (SAML) response returns an email address with an uppercase letter, Keycloak treats it as a new record.

The duplicate key violation occurs because the username or **Provider User ID** already exists in the database.

## **Resolution:**

1. In the Keycloak Admin Console, open the individual user record.
2. On the **Identity Provider Links** tab, select **Remove**.
3. Have the user re-attempt login through the Domino UI.

### **Notes**

To understand why Keycloak is treating the user as a new record, review the SAML requests and responses exchanged between Keycloak and the SSO provider.


## Related topics

- [Troubleshooting](/knowledge-base/troubleshooting-overview.md)
- [Set up LLM access](/cloud/platform-capabilities/features/llms/index.md)
- [Policy components](/cloud/platform-capabilities/features/governance/define-governance-policies/policy-components.md)
- [Use Posit Package Manager in a workspace](/cloud/platform-capabilities/core-concepts/workspaces/use-posit-package-manager.md)