[keycloak-dev] Allow multiple users with the same email

Hi, I'm involved in a project where we use Keycloak as Identity Broker, and so far we've been very happy with Keycloak, and implemented a few SPIs to do some special things, but now we've hit a snag... In our setup we have many clients using the Identity Broker which then again has many Identity Providers from which the user can chose one to use for login. Our problem is that the same user (using one email address) can exist in 2 or more Identity Providers, and we do not want to link these accounts. The reason for not linking the accounts is that the user can be given special privileges in clients, based on which Identity Provider the user comes from. These privileges should not be carried over from one Identity Providers user to another since the same user might be an administrator when coming the one Identity Provider and a common user when coming from a different Identity Provider. So, is it possible to allow multiple users to have the same email address? Looking at the source code there are checks for duplicated user-emails in most places where users are created... Could a solution be to implement a custom authenticator that replaces IdpCreateUserIfUniqueAuthenticator which does not check for duplicated emails, or are there database constraints that will prohibit this? An alternative solution could perhaps be a custom authenticator that simply deletes existing users with the same email address? I hope you can give me some pointer on how to proceed... -- Best regards, Tomas Groth Christensen Softwaredeveloper Danish Maritime Authority