title: Keycloak 15.0.2 - UserFederation and AccessToken mismatch on first run
body: <p>As the title says, I'm developing a Custom User Storage Provider (here forth SPI) with Keycloak 15.0.2.</p>
  <p>I’m having trouble sorting an issue where the very first access token that is issued, does not match the expected format (is missing some fields) but also seems to be issued for a different user, if I am to judge only based on the <code>sub</code> field of the <code>AccessToken</code> generated.</p>
  <p>To ease reproduction of the issue, you can find my repository on Github <a href="https://github.com/CelsoSantos/keycloak-labs-base" rel="nofollow noreferrer">here</a> with a complete sample FE and BE along with the keycloak configuration. I also included samples of the result tokens, jwt.io links and logs on <a href="https://github.com/CelsoSantos/keycloak-labs-base/blob/main/LOGS.md" rel="nofollow noreferrer">LOGS.md</a> file on the repo.</p>
  <p>I think I understand why this mismatch is happening, though.</p>
  <p>Due to the fact that I start with an empty collection of users on keycloak, I need to create the users on their first login. All I have to start with is their email address which is input on the login screen.
  With this information, I setup a “temporary” Federated User until I get the user data from the “real” IDP on the isValid method (where the user actually logs-in into the third party IDP) and then get his details, which are then used to fill a more complete FederatedUser profile and store it on the userLocalStorage.</p>
  <p>It's basically this logic (it's all also explained in comments in the repo's code):</p>
  <ul>
  <li>Create an adapter/model based solely on the email from the login form to be used temporarily.</li>
  <li>Proceed with normal operation.</li>
  <li>Then on the <code>isValid()</code> method:
  <ol>
  <li>login the user through the REST call to the backend and get the <code>JSESSION</code> token</li>
  <li>on a separate call, call the Current-User REST endpoint to get user details and map them to a Dto object</li>
  <li>create a new adapter, based on the Dto object (which already contains all the user details like name, phoneNumber, etc) and from that, add to storage as a <code>ksession.userLocalStorage().addUser()</code> user and enrich with custom attributes (to later be mapped into the <code>AccessToken</code>)</li>
  <li>when (and if) added, clean cache with <code>ksession.userCache().clear()</code></li>
  </ol>
  </li>
  <li>Proceed with normal operation</li>
  </ul>
  <p>However, I think that the ID/model of that first temporary user is the one that is actually being used during the issuance of the first <code>AccessToken</code> that is generated and is being cached somehow on some other class which then generates the <code>AccessToken</code> with missing information/not the correct user model.</p>
  <p>When I reload the page (forcing it to go through the login flow again), I then get the correct <code>AccessToken</code> with all the fields I expected the first one to have. I also noticed that the <code>sub</code> of the tokens are different, and this is what leads me to this conclusion.</p>
  <ul>
  <li>Does this flow/conclusion seem correct to you?</li>
  <li>And more importantly, how can I fix this?
  <ul>
  <li>I have no way of getting all the user data at first or a way to import it (ideally, I didn’t even wanted to Federate, just some ReadOnly data would have been enough if I could modify the AbstractUserAdapter attributes).</li>
  </ul>
  </li>
  <li>Can I somehow access the CredentialInput outside the isValid method?
  <ul>
  <li>That’s the only way I’d have to grab all the user data since the beginning.</li>
  </ul>
  </li>
  </ul>
  <p>I’d really appreciate any help you could spare. The reproduction code is just a clone/docker up away and will replicate the issue perfectly.
  Please help me figure out how to make sure the token get properly set/issued the first time around</p>
  <p>Thanks</p>