UserFederationRequest
The request body contains optional and mandatory parametersfor configuring LDPA user federation provider.
Properties
The name of attribute which is used as RDN(top attribute) of typical user DN. Usually its same as LDAP Username attribute, however its not required. For example for Active directory its common to use ‘cn’ as RDN attribute when username attribute might be ‘sAMAccountName’.
Password of LDAP admin.
DN of ldap admin which will be used by Keycloak to access LDAP server.
Name of the LDAP attribute which is used as unique object identifier for objects in LDAP.
Connection url to your ldap server.
Full DN of LDAP tree where your users are.
Name of LDAP attribute which is mapped as keycloak user name. For many LDAP server vendor it can be uid. For active directory it can be sAMAccountName" or cn. The attribute should be filed for all user records you want to import from LDAP to keycloak.
All values of LDAP Object class attribute for users in LDAP divided by comma.
The request body contains parameter to map between Keycloak and Ldap.
Name of the user-federation configuration
LDAP vendor (provider). For Active Directory use ‘AD’ and for ‘Redhat directory server’ use ‘rhds’.
Priority of provider when doing a user lookup. Lower first.
Should newly created user will be created with LDAP store. Priority effect which provider is chosen to sync new user. The setting is applied only for WRITABLE edit mode.
If true, users will imported into keycloak DB and configured by the sync policies. The values could be “true” or “false”. The default is “true”
If provider is disabled, it will not be considered for queries and imported users will be disabled and read-only until the provider is enabled again. The values could be “true” or “false”. The default is “true”
There are 3 possible values, READ_ONLY,WRITABLE and UNSYNCED. READ_ONLY is read-only ldap store. WRITABLE means data will be synced back to the LDAP on demand and UNSYNCED means user data will be imported but not synced back to LDAP. DEFAULT is “READ_ONLY”.
Type of Authentication method used during LDAP bind operation.Supported values are ‘simple’ and ’none’. Default is ‘simple’
The request body contains advanced parameter to configure user preference.
JSON Example
{
"bind_dn": "ou=users",
"connection_url": "http://<ip:port>",
"name": "my-ldap-config",
"rdn_ldap_attribute": "uid",
"user_object_classes": "inetOrgPerson, organizationalPerson",
"username_ldap_attribute": "cn",
"users_dn": "ou=users,dc=tco,dc=com",
"uuid_ldap_attribute": "uid",
"vendor": "AD"
}
Parameter To
Configure User Federation
