# SAML/ Advanced claim to role mapper only works once per user login

**URL:** <https://forum.keycloak.org/t/saml-advanced-claim-to-role-mapper-only-works-once-per-user-login/24591>\
**Category:** Getting advice\
**Created:** [February 15, 2024, 2:31pm UTC](https://forum.keycloak.org/t/saml-advanced-claim-to-role-mapper-only-works-once-per-user-login/24591 "2024-02-15T14:31:50Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![daw](https://avatars.discourse-cdn.com/v4/letter/d/258eb7/32.png) [@daw](https://forum.keycloak.org/u/daw)\
**Post date:** [February 15, 2024, 2:31pm UTC](https://forum.keycloak.org/t/saml-advanced-claim-to-role-mapper-only-works-once-per-user-login/24591/1 "2024-02-15T14:31:50Z")

</div>

I’ve configured Google Workspace SSO for Keycloak via SAML 2.0. I need to sync the groups from google with roles in keycloak. To do soI 'm using “Advanced claim to role” mapper. However this only works once per user login (doesn’t matter which sync mode) and on the second login attempt it fails due to Keycloak attempting to append the same user to the same role and prints an error. Any suggestions on how to get around this will be very much appreciated.

---

<div class="post-metadata">

**Author:** ![daw](https://avatars.discourse-cdn.com/v4/letter/d/258eb7/32.png) [@daw](https://forum.keycloak.org/u/daw)\
**Post date:** [February 16, 2024, 8:41am UTC](https://forum.keycloak.org/t/saml-advanced-claim-to-role-mapper-only-works-once-per-user-login/24591/2 "2024-02-16T08:41:14Z")

</div>

I think it was worth mentioning that I am doing user federation with User SPI. The issue only happens with federated users.