Client login failure when Identity provider link already exists in Keycloak

Last Updated : Jun 10, 2026 |

Condition

Users cannot log in to client.

Cause

The Identity Provider (IdP) link in Keycloak account already exists.

Solution

Procedure

  1. To Create a New Flow, do the following:
    1. Navigate to Authentication > Flows.
    2. Click Create and give the name for the flow as Auto Link Identity Provider Flow.
    3. For Flow type, select Basic Flow.
    4. Click Add execution > Automatically set existing user > Add.
  2. To Configure Authenticators, do the following:
    1. For Automatically set existing user, select Alternative.
    2. For Create User if Unique, select Alternative.
      Note:

      Do not add any authenticators or subflows to this configuration.

  3. To Update the Identity Provider, do the following:
    1. Navigate to Identity Providers and select the required provider.
    2. Enable Trust Email.
    3. For First login flow, change to Auto Link Identity Provider Flow as given in 1.b.
    4. For Sync Mode, select Force.
  4. Click Save.