Repository navigation
Replies: 1 comment
|
Have you found any solution for your problem? We are facing the same issue, not being able to resolve this hierarchy issue, would make using keycloak not interesting.. |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
We are using LDAP federation to sync groups using the
group-ldap-mapper. It works quite well while we only had a few groups with a flat hierarchy, but now we want to move to a more fine grained hierarchical group model, which should be mirrored between LDAP and Keycloak.I would like to have a group hierarchy similar to this:
note the two subgroups of the same name, which are distinct groups on Keycloak (according to their UUID and in a test realm without LDAP sync).
Once synced to LDAP they are maped into three (not four) groups in LDAP:
cn=one,ou=groups,dc=test,dc=comwith membercn=bar,ou=groups,dc=test,dc=comcn=two,ou=groups,dc=test,dc=comwith membercn=bar,ou=groups,dc=test,dc=comcn=bar,ou=groups,dc=test,dc=comwith no membersThis is not my intention as I would like to have
/one/barand/two/barto be distinct groups and idealy show up as subgroups in LDAP (e.g.,cn=bar,cn=one,ou=groups,dc=test,dc=com).If I go the other way, create the hierarchy in the LDAP directory, with subgroups as intended, only the base groups are synted to Keycloak and any subgroups are skipped.
Is there a way to get the hierarchy mirroed between LDAP and Keycloak to avoid subgroup names from overlapping?
The
group-ldap-mapperhas the following configuration:All reactions