# How can I correctly invoke a specific User Storage SPI based on OIDC clientId (or other parameter)?

**URL:** <https://forum.keycloak.org/t/how-can-i-correctly-invoke-a-specific-user-storage-spi-based-on-oidc-clientid-or-other-parameter/27565>\
**Category:** Getting advice\
**Tags:** authentication, oidc\
**Created:** [August 23, 2024, 12:52pm UTC](https://forum.keycloak.org/t/how-can-i-correctly-invoke-a-specific-user-storage-spi-based-on-oidc-clientid-or-other-parameter/27565 "2024-08-23T12:52:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![yurader](https://avatars.discourse-cdn.com/v4/letter/y/3e96dc/32.png) [@yurader](https://forum.keycloak.org/u/yurader)\
**Post date:** [August 23, 2024, 12:52pm UTC](https://forum.keycloak.org/t/how-can-i-correctly-invoke-a-specific-user-storage-spi-based-on-oidc-clientid-or-other-parameter/27565/1 "2024-08-23T12:52:36Z")

</div>

QUESTION: How can I correctly invoke a specific User Storage SPI in OIDC authentication flow, given that we have multiple User Storage SPIs and need to select a particular one based on the current OIDC client’s clientId (or another parameter)?

Specific example (using keycloak 24.0.3):

At the moment, there are two implemented user storage providers: **AlphaUSP** and **BravoUSP**. For OIDC clients with clientId = ‘ **bravo** ’, I want to add custom logic for the `getUserByUsername(RealmModel realmModel, String userName)` method. The logic is as follows: if the user is not found in the internal Keycloak DB, the user is fetched from an external service by making a REST API call. Therefore, I implement this logic in the `getUserByUsername()` method of **BravoUSP**.

An IMPORTANT nuance is that I want this logic to be executed ONLY for clients with clientId = “ **bravo** ”, and I don’t want the `getUserByUsername()` method in **AlphaUSP** to be executed if the user is not found by **BravoUSP**.

We plan to achieve this by using the following workaround:

In **BravoUSP** :

```auto
getUserByUsername(...) {
    if (!"bravo".equals(Optional.ofNullable(keycloakSession.getContext().getClient()).map(ClientModel::getClientId).orElse(null))) {
        return null;
    }
    return getUserFromExternalAPI(...);
}

```

In **AlphaUSP** :

```auto
getUserByUsername(...) {
    if (!"alpha".equals(Optional.ofNullable(keycloakSession.getContext().getClient()).map(ClientModel::getClientId).orElse(null))) {
        return null;
    }
    return findUser(...);
}

```

Is this workaround a good approach (returning null for alien clientIds)? If not, please advise on a better solution.

---

<div class="post-metadata">

**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\
**Post date:** [August 23, 2024, 6:12pm UTC](https://forum.keycloak.org/t/how-can-i-correctly-invoke-a-specific-user-storage-spi-based-on-oidc-clientid-or-other-parameter/27565/2 "2024-08-23T18:12:57Z")

</div>

The UserStorageSPI is not designed to support such a use case. If you really want to get annoyed, you‘ll habe to go with lots of ugly code in user storage and authenticators. Good luck.