Repository navigation
Keycloak - SSO Configuration - userPrincipalName (AD account attribute) #51702
Replies: 5 comments
|
In AD, I have the |
|
you want users to log in with jkowalski or jkowalski@abc.xxx.com? |
|
Yes — and you don't need a new AD attribute for it. In your LDAP user federation provider, change Username LDAP attribute from Typical settings for AD:
Two caveats:
|
|
This method doesn't work. For my accounts, the UPN domain format is: firstname.lastname@abc.xxx.com The Keycloak application requires the format: e.g., jkowalski@abc.pl In the AD domain, I do not have an attribute with the value: e.g., jkowalski@abc.pl I only have: e.g., jkowalski Is it possible to manipulate the attribute within the application? The principal name received by the browser comes from the GSS context: authenticatedKerberosPrincipal = gssContext.getSrcName().toString(); Since the name is derived from the context, we have no control over the "principalName" value sent to Keycloak |
|
Setting Username LDAP attribute to No new AD attribute is needed. Clear that field: With it empty, Keycloak drops the
The field exists since 22.0.2. Before that Keycloak always used the part before |
Uh oh!
There was an error while loading. Please reload this page.
Hello,
I am having trouble configuring SSO in Keycloak. My AD domain accounts have a
userPrincipalNameattribute in the formatfirstname.lastname@abc.xxx.com(e.g.,jan.kowalski@abc.xxx.com). However, I log in to the application using the first letter of my first name followed by my surname (e.g.,jkowalski).By default, Keycloak uses the
userPrincipalNameattribute. Is it possible to configure SSO in Keycloak without creating a new attribute in AD, while still allowing users to log in to the application using the same username they use for Windows (e.g.,jkowalski)?All reactions