Claim to role mapper in Open ID Identity provider works only in first login

1

Hello.
We try to integrate external Open ID provider in keycloack.
We try to define a mapper of type claim to role, so if the logging in user has some claim with some value, he will be assigned to specific role in keyclack.

Unfortunately, It works only in the first user login when the keycloack creates appropriate linked user in its database In the next logins if the user claim was changed , he is not added to roles in keycloack even if he actually has the right claim with right value.
If i delete that user form internal keycloack database and try to login again by Open ID provider ,the user is created and added to all roles… but again, if the user has any change in his claim on the next login, the role membership is not updated…
Any bug or may by additional configuration is needed ?

2

Looking at mapper implementation and it seems like a bug to me. Here we should have also else branch, similarly to this. Could you please create an issue in our issue tracker?

3

I do have the same issue, any updates on this?

4

Change the sync mode to force.

5

We have the same problem, setting the sync to force does not fix it