Repository navigation
Replies: 2 comments 4 replies
|
Hi @jochenr, did you find the solution for this problem? |
|
HI @epif4nio, |
|
In my instance, the users' roles are managed within the application Keycloak is protecting. Keycloak is an identity broker for several different identity providers, and once a user logs in with one of those providers, I want to throw away all the roles those providers report, and replace them with whatever comes from my application. I'm trying to achieve that with a custom user storage provider, but perhaps a role mapper is a better way. I'm kinda new to Keycloak, and don't have any idea where to start, to evaluate that possibility. Would you care to give any more details of what you're doing? |
|
Hi @eggyknap, what I did is to extend org.keycloak.storage.ldap.mappers.AbstractLDAPStorageMapperFactory / org.keycloak.storage.ldap.mappers.AbstractLDAPStorageMapper. Actually my implementation is inspired by: And I think this link contains the perfect idea for your issue, too:-) |
|
I appreciate the hint! A cursory glance suggests the "storage mapper" idea in Keycloak is exclusive to LDAP, and so not applicable to my JDBC database, but I'll look more closely. Thanks again. |
|
... however I now discover that there is a SAML role mappings SPI, which sounds exactly like what I want... |
Uh oh!
There was an error while loading. Please reload this page.
Hello!
If have a configuration issue.
We have the constallation that we use 2 LDAP servers for our user base. One (MS Acrive Directory) contains the credentials and some basic attributes. The other LDAP server contains the roles for the (same) users.
If I configure both LDAP servers in the User Federation menu of keycloak the first one is able to import the users, but the second can obviously not import the same users again.
I get:
User with ID 'dd3cb3a3-c325-40cd-a055-3293d242a1b4' is not updated during sync as he already exists in Keycloak database but is not linked to federation provider 'ldap-1
What I want is that the second ldap provider adds/merges the roles while importing.
Any ideas how to achieve that (without a custom provider)?
Thank you in advance
All reactions