Repository navigation
Replies: 2 comments
|
Hey mate! Did you end up figuring this out? It seems that FreeIPA is basically locked into having to manually create users in it and there are absolutely no self-service solutions that do more than import from it and write password changes to it. I came across these two unanswered threads here: https://keycloak.discourse.group/t/error-when-syncing-keycloak-with-freeipa/4183 In a nutshell, it seems like it simply can't be done, which is INSANE as both FreeIPA and Keycloak are developed by Red Had. Not to mention this exact function works with any other connected LDAP source other than FreeIPA I also made a reddit post here: https://www.reddit.com/r/selfhosted/comments/yqkgf8/can_authentikkeycloak_andor_any_other_auth/ I think I'm about to migrate everything to Authentik and run an LDAP server there, which is insane considering the implication that I'm about to move from enterprise level software to a solution that was created by one guy in their spare time, that only just became a company and is only now just hiring for it. Craziness |
|
I want to provide some insight here. In order for this to work, (I presume) that you have to create a mapper for all the ldap attributes and object classes that FreeIPA expects to be there. If you've looked at the ldap information for a newly created user, you can see it's easily 40+ attributes that need to be set. Additionally, if you're using the I don't really see this as an issue in FreeIPA but moreso an issue between an IdM and an IdP. The IdM and IdP each serve different roles, and if you want to propogate from the IdP -> IdM I presume you need to put in all the legwork that the IdM would do for you. For myself, I will continue to create users in FreeIPA and import them into Keycloak, but I may investigate what is necessary to create users in Keycloak and if it is indeed possible. Apologies for the necrobump, I came across this discussion while researching the issue myself and wanted to leave behind what I've figured out for the next person. |
Uh oh!
There was an error while loading. Please reload this page.
Hello all,
I have an issue configuring both systems Keycloak and FreeIPA to work with User Federation. Configuration on Keycloak side for the ldap (FreeIPA server) is as follows:
The below screenshot is from the Keycloak User Federation:
Importing users works flawlessly but the problems comes when I try to create user in Keycloak and expect it to be created on FreeIPA side - WRITABLE is on, and keycloak machine is enrolled into FreeIPA as a client (both OSes are Alma). There is no error, and Keycloak indicates that a new user is created.
However, in FreeIPA's web interface the user is missing and the most frustrating thing is if i try to create the very same username, FreeIPA returns that it can't add the user, because it already exists. I guess the issue would be somewhere either in Username/RDN LDAP attribute or UUID or even Custom User LDAP filter, but i'm lost a bit.
In case someone wants to help here what i've tried to play with:
Anyhelp on this will be much appreciated :")
Thank you in advance
All reactions