Wsrtjtyk

I'm using Keycloak for Identity Brokering through Google, Microsoft, etc. But Keycloak only allows one email per user. So the user can be authenticated only through one of the social login options (Google if gmail is added as user's email address, etc.). Is there any way to include more than one email per user, or any other workaround?

EDIT: (Editing based on comments to make scenario more clear)

In my scenario, I'm using a federated user store which contains a large number of users and and I need Keycloak to access all the emails linked to a user when that user is logging in using Google,Azure,etc. because Keycloak is using the email as the unique identifier for the authentication response from the social login provider. Without having the required email as the main email, Keycloak won't allow that user to log in through social IdP

Although, Keycloak emphasises on keeping a unique email,but there are certain scenarios where you may want to keep , say, secondary email.

This can be achieved in a couple of steps:

1. Add a custom attribute for secondary email in user like this:

2. Next , in your client create attribute mapper like this:

When I generated the token after above configuration, the new attribute was avialble in token. You can use this attribute in your app as you desire.

Parsed JWT: