Repository navigation
LDAP Login without user sync #15836
Replies: 1 comment
|
You can opt to not activate the periodic user sync feature, so users are imported into the Keycloak database when they first log in, which may help keep the database smaller until all users log in. If you want LDAP to be the source of truth at all times, you can set all federation (LDAP) mappers to always import the information (e.g. first name, last name, email address) from the LDAP backend when it is required. However, as far as I know, there is no setting to disable creating user entries in the Keycloak database altogether - and likely, some information is mandatory, since you need to keep track of user consent, OTP and WebAuthn tokens associated with the account, and so on. As far as the database is concerned, it is of course a matter of how many resources you are willing to allocate for the Keycloak database. Relational databases should be able to easily handle hundreds of thousands of records. LDAP is also a database, so I would not expect a relational database with the appropriate table indices to become a bottleneck. |
Uh oh!
There was an error while loading. Please reload this page.
Hi, I‘m trying to connect the Keycloak to a huge LDAP Server with 100k+ users. Since there are so many users, I do not want to import all users into the Keycloak. Instead I want to have some sort of live-lookup. (User tries to authenticate, Keycloak asks the LDAP Server if that user exists and the password matches…) (How) Is that possible? And if not: do you think having that many users might be an issue? Thanks for the help!
All reactions