Currently the role skips the identity provider if it already exists. We should support being able to update.