[{"label":"Latest (2.0.1)","version":"latest"}]


The request body contains optional and mandatory parametersfor configuring LDPA user federation provider.


advanced Optional

The request body contains advanced parameter to configure user preference.

bind_credential Optional

Password of LDAP admin.

bind_dn Optional

DN of ldap admin which will be used by Keycloak to access LDAP server.

bind_type Optional

Type of Authentication method used during LDAP bind operation.Supported values are ‘simple’ and ’none’. Default is ‘simple’

connection_url Optional

Connection url to your ldap server.

edit_mode Optional

There are 3 possible values, READ_ONLY,WRITABLE and UNSYNCED. READ_ONLY is read-only ldap store. WRITABLE means data will be synced back to the LDAP on demand and UNSYNCED means user data will be imported but not synced back to LDAP. DEFAULT is “READ_ONLY”.

enabled Optional

If provider is disabled, it will not be considered for queries and imported users will be disabled and read-only until the provider is enabled again. The values could be “true” or “false”. The default is “true”

import_enabled Optional

If true, users will imported into keycloak DB and configured by the sync policies. The values could be “true” or “false”. The default is “true”

mapper Optional

The request body contains parameter to map between Keycloak and Ldap.

name Optional

Name of the user-federation configuration

priority Optional

Priority of provider when doing a user lookup. Lower first.

rdn_ldap_attribute Optional

The name of attribute which is used as RDN(top attribute) of typical user DN. Usually its same as LDAP Username attribute, however its not required. For example for Active directory its common to use ‘cn’ as RDN attribute when username attribute might be ‘sAMAccountName’.

sync_registration Optional

Should newly created user will be created with LDAP store. Priority effect which provider is chosen to sync new user. The setting is applied only for WRITABLE edit mode.

user_object_classes Optional

All values of LDAP Object class attribute for users in LDAP divided by comma.

username_ldap_attribute Optional

Name of LDAP attribute which is mapped as keycloak user name. For many LDAP server vendor it can be uid. For active directory it can be sAMAccountName" or cn. The attribute should be filed for all user records you want to import from LDAP to keycloak.

users_dn Optional

Full DN of LDAP tree where your users are.

uuid_ldap_attribute Optional

Name of the LDAP attribute which is used as unique object identifier for objects in LDAP.

vendor Optional

LDAP vendor (provider). For Active Directory use ‘AD’ and for ‘Redhat directory server’ use ‘rhds’.

JSON Example

    "bind_dn": "ou=users",
    "bind_type": "simple",
    "connection_url": "http://<ip:port>",
    "edit_mode": "READ_ONLY",
    "enabled": true,
    "import_enabled": true,
    "name": "my-ldap-config",
    "priority": 1,
    "rdn_ldap_attribute": "uid",
    "sync_registration": false,
    "user_object_classes": "inetOrgPerson, organizationalPerson",
    "username_ldap_attribute": "cn",
    "users_dn": "ou=users,dc=tco,dc=com",
    "uuid_ldap_attribute": "uid",
    "vendor": "AD"
[{"label":"Latest (2.0.1)","version":"latest"}]
Parameter To

Patch User Federation


Was this page helpful?