[keycloak-user] Lookup user by ID in more than one Identity provider (ID is not unique)

Hi there, so I have the following scenario and hope you folks could help me out here: I've got a webapp and we're switching from old db-based login to keycloak. In our realm, we're federating the "old" userDB via an implementation of the User Federation SPI, and we're using spnego/kerberos authentication via federation of an Active Directory. Lookup is: 1. userDB 2. AD Now, use-case is as follows: 0. With kerberos-login, always use AD-login. => This works. :) But: there may be the same ID ("john.doe") in AD and userDB, but with different passwords. So, we want to achieve this: 1. When you use manual login (non-domain-pc or something), it should make no difference which password you enter, you get logged in, as the application itself don't care where you're from, it just needs the userdata. So, one might argue "why are you using the old userDB at all, then - you've got your AD, just use their data" - good question. But the userDB aggregates another AD, which is out of "political reasons" not accessible to us via keycloak identity federating / identity provider. We're trying to change this, but as you might know, these processes cost time.. time we do not have at the moment. So to get concrete: I implemented the Federation SPI and I think my starting point should be to change the overridden "getUserBy..."- methods which I pasted here: https://pastebin.com/ddZTYMD4 Now, instead of just returning null when isEmpty(), entity == null etc. is checked, my SPI impl. should be capable of calling the AD (possibly more than one in future) and check the same credentials against the AD database. And only if the user is not found in every provider, it should return null. So to be honest, I have no clue if this is a) the correct part I should start my call. May be isValid, though, for the User ("john.doe") itself IS found, but the password doesn't match b) where the correct point is '(if any) where to change this and c) how to make the call with my credentials to the AD, then. Would be super happy if anyone could help me out here! Best regards, Dominik