Repository navigation
Replies: 1 comment
|
The core mismatch is that LDAP Keycloak still uses LDAP for password validation and even performs LDAP checks for imported users. The Group LDAP mapper's There are also two model limitations here:
For 23k users, I would choose one of two architectures:
Deleting/reimporting users is not a safe synchronization strategy because it changes Keycloak IDs and can break links/consents. The official LDAP storage documentation also states that passwords are never imported and LDAP remains involved for imported users; the membership behavior is visible in |
Uh oh!
There was an error while loading. Please reload this page.
Originally posted on the Keycloak Forum.
We are attempting to federate users and groups from AD LDAP into Keycloak. We do not want to maintain a live connection to LDAP so we are using a Sync Mode of Import. We ideally would like the entire LDAP tree to be stored in Keycloak’s databases and maintain group to group memberships as well as user to group memberships. We were using the Admin UI for this exercise.
We have been unable to successfully do this given the size and complexity of our LDAP environment.
Issues:
Setting up the Group mapper - we ideally want to set Preserve Inheritance to “ON” BUT our AD environment has groups with more than 1 parent group and this fails to sync. into Keycloak. A known issue from researching.
We run with Preserve Group Inheritance to “OFF”. We do seem to be able to pull down groups into Keycloak but with many retries as the Admin UI always seem to report an error even if the sync is still running. May be related to timeout settings and batch sizes but so far we have not found the right combo. What we lose is group to group memberships. With Preserve Group Inheritance = OFF (because of the single parent limitation), Group member attributes are not fetched during group sync.
Sync of Users never seems to work. We have a large set of users (approx. 23000) and even scoping the base DN to only retrieve about 6000 users does not seem to work. It seems to drop the LDAP connection. Research indicates that you can configure LDAP to maintain the connection but its has not worked through the Keycloak admin UI. We think this may have to do with the fact that it also is pulling down all user memberships to groups (transitively) as well. We have some groups with 1000s of user members.
Keycloak imports are all or nothing. When you restart a timed-out LDAP sync in Keycloak, it starts over from the beginning. Keycloak does not save progress or use a checkpoint system for a running batch import. We have yet to be able to sync all users.
User-to-group membership changes for existing users are permanently ignored by all periodic sync mechanisms. IMPORT mode means all group membership data is written to Keycloak’s DB at user creation time and never live-queried again. Since memberships are not auto-resynced, you can end up with stale memberships after AD group changes.
If you can’t resync membership changes made in AD after original sync, how do you reliably resync those changes in to keycloak? I read that you have to delete the user and re-import them to pick up latest memberships which is unrealistic. Has anyone done something like this?
I won’t add any more issues at this point but I was wondering if anyone has experience with importing AD LDAP into Keycloak without maintaining a live connection to LDAP. Also any experience with dealing with any of the issues mentioned and if you found a workaround. We have not explored writing scripts or using the Keycloak API directly at this point.
Thanks.
All reactions