You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I don't know if this is a best practice or a poorly organized AD (if you know better, let me know).
Anyway, we couldn't change the AD structure and Keycloak doesn't handle this.
So, I was thinking about to possible solutions, even though the second is probably better.
Solution 1
Inside the user creation page, an attribute could be added that allows the admin to choose in which OU to put the user. The attribute could be of type select, so that the admin doesn't have to remember all the OU names.
A new setting could be added to the User Federation page, beside Relative user creation DN, of type boolean that enables or disables this behaviour.
Pros: does not require much configuration for a Keycloak admin to setup Cons: requires changing the already existing code for ldap, increasing the possibility of introducing new bugs for users that don't need this feature
Solution 2
A new LDAP mapper could be created that reads the OU name from a user attribute and prepends it to the user creation DN.
The Keycloak admin can create a custom attribute of type select with only the OUs where users can be created.
Pros: simpler and safer to implement — I guess — and doesn't require modifying the core LDAP user creation logic Cons: requires a little bit more configuration by a Keycloak admin to setup
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
The Problem
We were installing Keycloak for a customer and our objective was to completely move the user management process from AD to Keycloak.
We configured the LDAP user federation as
WRITABLE, but the customer had 5 different OUs for users.Something like this:
I don't know if this is a best practice or a poorly organized AD (if you know better, let me know).
Anyway, we couldn't change the AD structure and Keycloak doesn't handle this.
So, I was thinking about to possible solutions, even though the second is probably better.
Solution 1
Inside the user creation page, an attribute could be added that allows the admin to choose in which OU to put the user. The attribute could be of type select, so that the admin doesn't have to remember all the OU names.
A new setting could be added to the User Federation page, beside Relative user creation DN, of type boolean that enables or disables this behaviour.
Pros: does not require much configuration for a Keycloak admin to setup
Cons: requires changing the already existing code for ldap, increasing the possibility of introducing new bugs for users that don't need this feature
Solution 2
Pros: simpler and safer to implement — I guess — and doesn't require modifying the core LDAP user creation logic
Cons: requires a little bit more configuration by a Keycloak admin to setup
All reactions