KC-SERVICES0013 - error when automatically linking idp users with keycloak user

[reysuela]

Hi Team 👋,

I am getting this error when trying to request for auth token, keycloak does not seem to link the external user to the keycloak user.

Keycloak version: v26.2.5 (was initially found in v26.0.7)
Provisioning Tools: I am using Keycloak terraform provider(v5.1.1) to provision the resources, my plan is to create the user, groups via config and have it automatically link when user login via IdP.

Configuration:

1. keycloak users is pre-created with groups and email verified.
2. Authentication flow - I followed the steps to configure auto linking of user. https://www.keycloak.org/docs/latest/server_admin/index.html#automatically-link-existing-first-login-flow
   • Automatically set existing user (Alternative)
   • Create User If Unique (Alternative)
3. Realm setting -> User profile = Removed FirstName and LastName (auto link user without prompts)
4. Realm setting -> Login = Login with email (Enabled), Email as Username (Enabled), Verify Email (Enabled)
5. IdP configuration -> first login flow = (step2) (Auto-link user if exist flow)

Logs:

2025-06-04 16:02:32,199 WARN  [org.keycloak.services] (executor-thread-2) KC-SERVICES0013: Failed authentication: org.keycloak.authentication.AuthenticationFlowException
 at org.keycloak.authentication.AuthenticationProcessor.authenticateOnly(AuthenticationProcessor.java:1103)
 at org.keycloak.services.resources.LoginActionsService$1.authenticateOnly(LoginActionsService.java:924)
 at org.keycloak.authentication.AuthenticationProcessor.authenticate(AuthenticationProcessor.java:933)
 at org.keycloak.services.resources.LoginActionsService.processFlow(LoginActionsService.java:380)
 at org.keycloak.services.resources.LoginActionsService.brokerLoginFlow(LoginActionsService.java:956)
 at org.keycloak.services.resources.LoginActionsService.firstBrokerLoginGet(LoginActionsService.java:827)
 at org.keycloak.services.resources.LoginActionsService$quarkusrestinvoker$firstBrokerLoginGet_8353b960487f493f608861c3c713f082b792516d.invoke(Unknown Source)
 at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29)
 at io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:141)
 at org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:147)
 at io.quarkus.vertx.core.runtime.VertxCoreRecorder$15.runWith(VertxCoreRecorder.java:638)
 at org.jboss.threads.EnhancedQueueExecutor$Task.doRunWith(EnhancedQueueExecutor.java:2675)
 at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2654)
 at org.jboss.threads.EnhancedQueueExecutor.runThreadBody(EnhancedQueueExecutor.java:1627)
 at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1594)
 at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:11)
 at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:11)
 at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
 at java.base/java.lang.Thread.run(Unknown Source)

Additional debug logs:

2025-06-04 16:02:32,200 WARN  [org.keycloak.events] (executor-thread-2) type="IDENTITY_PROVIDER_FIRST_LOGIN_ERROR", realmId="test-realm", realmName="test-realm", clientId="test_client_public", userId="null", ipAddress="x.x.x.x", error="invalid_user_credentials", identity_provider="idptest", auth_method="openid-connect", redirect_uri="http://localhost:8080/*", identity_provider_identity="user@test.com", code_id="1111111-94d7-4be6-ab4b-2222222"
2025-06-04 16:02:32,275 DEBUG [org.hibernate.internal.util.EntityPrinter] (executor-thread-2) org.keycloak.models.jpa.entities.UserEntity{lastName=null, federatedIdentities=<uninitialized>, realmId=test-realm, credentials=<uninitialized>, createdTimestamp=1749009226420, serviceAccountClientLink=null, enabled=true, notBefore=0, emailConstraint=user@test.com, emailVerified=true, firstName=null, requiredActions=<uninitialized>, federationLink=null, attributes=<uninitialized>, id=fb08e005-1e9e-4c6e-92a5-c6f4beaa378d, email=user@test.com, username=user@test.com}

Observations:
If the user does not exist, I am able to get an auth token and the user is created in Keycloak. There are some instances when I terraform destroy and apply again, the linking will just work. I tried different setting in the authentication flow, but nothing works.

Am I missing something in my setup? Thank you!

[seema1322]

Hi @reysuela did you got any fix for this issue as I am also facing same