Multiple group mappers not working since version 26

Before reporting an issue

• I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

No response

Describe the bug

I'm using Keycloak with the operator in OpenShift. We have a user federation with a Microsoft AD and configured multiple group mappers (each with another LDAP Groups DN). Up to version 24 that worked flawlessly.

Since the upgrade to version 26, we have the following problem: All the groups are still listed in "Groups". But when I go to "Users", search one there and hav a look at it's "Groups"-Tab, there are only the groups of one of the mappers shown. The same goes for the groups in the user JWT token, so it's not a display bug.

So it seems, that the sync of groups to the user has changed and now only works for one group mapper.

Version

26.4.7

Regression

• The issue is a regression

Expected behavior

All groups received via the multiple group mappers are synced to the users.

Actual behavior

Only the groups of one group mapper are synced to the users.

How to Reproduce?

You need an AD (or maybe OpenLDAP) with groups in multiple paths.

Create a realm with a MS AD user federation. Create multiple group mappers, that point to different paths (LDAP Groups DN). Sync groups and users Go to "Users", search and select one and look at its "Groups"-Tab, whether it contains groups from all mappers.

Anything else?

We tried this with multiple keycloak instances on OpenShift and OKD, ranging from versions 26.2.11 to 26.4.7.