Bug #56096 introduced "univention-keycloak saml-client-nameid-mapper" but it's not idempotent, which makes it unsuitable for the use in joinscripts. root@primary20:~# univention-keycloak saml-client-nameid-mapper create \ urn:federation:MicrosoftOnline \ entryUUID \ --mapper-nameid-format "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" \ --user-attribute entryUUID \ --base64 && echo ok Traceback (most recent call last): File "/usr/sbin/univention-keycloak", line 3450, in <module> sys.exit(main()) ^^^^^^ File "/usr/sbin/univention-keycloak", line 3446, in main return opt.func(opt) or 0 ^^^^^^^^^^^^^ File "/usr/sbin/univention-keycloak", line 2306, in create_saml_nameid_mapper session.create_mapper(opt.clientid, payload) File "/usr/sbin/univention-keycloak", line 351, in create_mapper self.add_mapper_to_client(_id, payload) File "/usr/lib/python3/dist-packages/keycloak/keycloak_admin.py", line 3656, in add_mapper_to_client return raise_error_from_response(data_raw, KeycloakPostError, expected_codes=[201]) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3/dist-packages/keycloak/exceptions.py", line 192, in raise_error_from_response raise error( keycloak.exceptions.KeycloakPostError: 409: b'{"errorMessage":"Protocol mapper exists with same name"}'
[5.2-2] 58989b0669a | Fix exception handling of saml-client-nameid-mapper create Package: univention-keycloak Version: 3.2.3 Release: 5.2-0 Scope: errata5.2-2
[5.2-2] d62a52d4b96 | Advisory
Tests: OK Code review: OK YAML: OK
<https://errata.software-univention.de/#/?erratum=5.2x180>