matrix: Keycloak SSO login fails with "User exists" after the MAS upstream switch #283

New issue

Open

opened 2026-08-07 21:19:24 +02:00 by dominik.polakovics · 1 comment

dominik.polakovics commented

2026-08-07 21:19:24 +02:00

Owner

Since c304f5c switched the MAS upstream provider from Authelia to Keycloak, logging in to Element fails:

Unexpected error — User exists
Upstream account provider returned "dominik.polakovics" as username, which is not linked to that upstream account. Your homeserver does not allow linking an upstream account to an existing account

The provider id in hosts/fw/vms/web/matrix.nix stayed 01KJPRKN397E5N8D0CA2Z3TJ7Y while the IdP behind it changed. MAS keys an upstream identity by (provider id, subject), so every existing upstream_oauth_links row still carries the Authelia subject. Keycloak returns its own sub, MAS finds no link, provisions a fresh account, derives the same localpart from the email claim — and that localpart is already taken.

The refusal itself is claims_imports.localpart.on_conflict defaulting to fail. Existing accounts need their link repointed at the new subject on first Keycloak login.

Related to #266.

Since c304f5c switched the MAS upstream provider from Authelia to Keycloak, logging in to Element fails: > **Unexpected error — User exists** > Upstream account provider returned "dominik.polakovics" as username, which is not linked to that upstream account. Your homeserver does not allow linking an upstream account to an existing account The provider id in `hosts/fw/vms/web/matrix.nix` stayed `01KJPRKN397E5N8D0CA2Z3TJ7Y` while the IdP behind it changed. MAS keys an upstream identity by `(provider id, subject)`, so every existing `upstream_oauth_links` row still carries the Authelia subject. Keycloak returns its own `sub`, MAS finds no link, provisions a fresh account, derives the same localpart from the email claim — and that localpart is already taken. The refusal itself is `claims_imports.localpart.on_conflict` defaulting to `fail`. Existing accounts need their link repointed at the new subject on first Keycloak login. Related to #266.

dominik.polakovics commented

2026-08-07 21:21:14 +02:00

Author

Owner

Fix is on branch fix/mas-keycloak-localpart-conflict (63d5366) — sets claims_imports.localpart.on_conflict: replace on the MAS upstream provider.

PR not opened from this run: POST /agent/v1/prs returns 404 (this run has no claimed issue, so the create route is not registered). Compare link: https://git.cloonar.com/Cloonar/nixos/compare/main...fix/mas-keycloak-localpart-conflict

Fix is on branch `fix/mas-keycloak-localpart-conflict` (63d5366) — sets `claims_imports.localpart.on_conflict: replace` on the MAS upstream provider. PR not opened from this run: `POST /agent/v1/prs` returns 404 (this run has no claimed issue, so the create route is not registered). Compare link: https://git.cloonar.com/Cloonar/nixos/compare/main...fix/mas-keycloak-localpart-conflict