Repository navigation
Keycloak auth via ldap group #39969
|
Hi everyone, I'm planning to implement Keycloak SSO for our infrastructure and need advice on maintaining our current LDAP group-based authorization model. Current setup: How do I configure Keycloak to preserve this LDAP group-based authorization model? I want users to only access services they're currently authorized for based on their LDAP group membership. I'm looking for the standard/recommended approach to handle this common migration scenario. The goal is SSO with preserved authorization boundaries. Environment: Thanks! |
Replies: 1 comment
|
From your post it sounds like you will be federating the users into Keycloak via LDAP, the following operates on that assumption. I will also stick to OIDC for the SSO integration protocol, though similar concepts apply to SAML. NOTE: this is dependant on the service implementing claim based access control, from a brief look at their docs it looks like Atlassian doesn't provide that. But I do know from experience that gitlab does This can be accomplished by configuring a group mapper in the LDAP federation provider, this maps LDAP group membership -> Keycloak group membership. First you will need to create the relevant Keycloak groups (in your case: jira, confluence, remoteusers), then configure the mapper. Once your LDAP groups are being mapped to users groups (e.g. when a user in your LDAP system has the jira group, the users keycloak profile also shows the jira group) you configure a claim mapper so that the users groups are visible in the token. You then integrate Keycloak SSO to your service via OIDC. And in the service you configure claim based access to read these groups and only permit users with given groups access. Simplified:
|
From your post it sounds like you will be federating the users into Keycloak via LDAP, the following operates on that assumption. I will also stick to OIDC for the SSO integration protocol, though similar concepts apply to SAML.
NOTE: this is dependant on the service implementing claim based access control, from a brief look at their docs it looks like Atlassian doesn't provide that. But I do know from experience that gitlab does
This can be accomplished by configuring a group mapper in the LDAP federation provider, this maps LDAP group membership -> Keycloak group membership. First you will need to create the relevant Keycloak groups (in your case: jira, confluence, remoteusers), then c…