Duplicate Keycloak Users with ADF

[fsanna]

Hello, I'm trying to set up ACS Community Version (SDK 4.7) to use Keycloak as Identity Service, and to use ADF to manage the authentication and authorization process in my UI app.

I managed to set everything up using different guides and my app actually connects to ACS and manages Keycloak users correctly, adding them to the `people` container of ACS.

Unfortunately, I got a problem which has already been asked some years ago in the forum, i.e. this thread. My Keycloak users are being duplicated when they login for the first time in the UI application. I can be sure about this since the admin node repository presents two entries for the same user.
This happens only when the user login for the very first time; the next ones, it does not duplicate it anymore.

Nevertheless, I get this error in the ACS logs:

INFO  [security.person.PersonServiceImpl] [http-nio-8080-exec-7] Splitting 1 duplicate person objects.
ERROR [util.transaction.TransactionSupportUtil] [http-nio-8080-exec-7] After completion (committed) exception
rg.alfresco.repo.security.permissions.AccessDeniedException: 02010242 Only users with ROLE_ADMINISTRATOR are allowed to manage users.

and this error appears everytime the user login, even if it is not duplicated anymore.

As I said before, I'm using ADF to connect to ACS, and I'm defining the file `app.config.json` in the following way:

{
    "$schema": "../node_modules/@alfresco/adf-core/app.config.schema.json",
    "ecmHost": "{protocol}//{hostname}{:port}",
    "providers": "ECM",
    "authType": "OAUTH",
    "identityHost": "http://localhost/keycloak/realms/myrealm",
    "oauth2": {
        "host": "http://localhost/keycloak/realms/myrealm",
        "clientId": "myclient",
        "scope": "openid",
        "secret": "",
        "implicitFlow": true,
        "silentLogin": true,
        "redirectUri": "/home",
        "redirectUriLogout": "/",
        "redirectSilentIframeUri": "/assets/silent-check-sso.html"
    },
    "application": {
        "name": "Alfresco ADF Application"
    },
    "languages": [
        {
            "key": "en",
            "label": "English"
        },
        {
            "key": "it",
            "label": "Italian"
        }
    ],
    "logLevel": "trace"
}

while the ACS properties for connecting to Keycloak are the following ones:

authentication.chain=identity-service1:identity-service,alfrescoNtlm1:alfrescoNtlm
identity-service.enable-basic-auth=false
identity-service.auth-server-url=http://${HOST_IP}/keycloak
identity-service.realm=${REALM_NAME}
identity-service.resource=${CLIENT_NAME}
identity-service.credentials.provider=secret
identity-service.credentials.secret=${CLIENT_SECRET}
identity-service.authentication.enabled=true
identity-service.authentication.sso.enabled=true
identity-service.ssl-required=external
identity-service.autodetect-bearer-only=true

Has there been any solution on how to solve this problem?

Thanks in advance!

[LeoMattioli]

Hi Fsanna,

try to set the scope in this way in the app.config.json

"scope": "openid profile email"

Here's a link to some documentation.

My guess is that keycloak is sending to ACS only the openid Identifier and ACS creates a new user because the id is unknown.

Best regards,

Leo Mattioli