Adding an LDAP provider

You can add users by integrating Keycloak with an LDAP provider.

1. Navigate to Configure > User federation.
2. On the User federation pane, click Add Ldap providers.
   If there are existing providers added, click Add new provider, and select LDAP.
   
   
   
3. On the Add LDAP provider pane, complete the following settings to configure connection to the LDAP directory. For information about each setting, click the corresponding tooltip.
   1. In the General options section, configure the following settings:
      • UI display name: Enter a display name for the provider or accept the default ldap. This is the name that will appear in the Keycloak Administration Console.
      • Vendor: Select the LDAP provider or Other if the provider is not listed. For example, select Other if the provider is OpenLDAP.
   2. In the Connection and authentication settings section, configure the following settings, and then click Test Connection to confirm that the connection is successful.
      • Connection URL: Enter the connection URL for the LDAP server. The basic LDAP URL format is ldap://<hostname>:<port> or ldaps://<hostname>:<port> for encrypted connection. The default port for LDAP in Keycloak is 389 for unencrypted connection and 636 for encrypted connection.
      • Enable StartTLS: Accept the default Off.
      • Use Truststore SPI: Accept the default Always.
      • Connection pooling: Accept the default Off.
      • Connection timeout: Leave this box blank unless you want to set a timeout in milliseconds.
   3. Configure the following authentication settings, and then click Test Authentication to confirm that the authentication is successful:
      • Bind type: Select none or simple for the authentication method used during the LDAP bind operation. The default is simple, which requires bind credentials.
      • Bind DN and Bind credentials: If you selected simple as the bind type, enter a Distinguished Name (DN) to identify the user that Keycloak will use to bind the LDAP server for authentication and the user password. This is usually the LDAP administrator.

        In the LDAP directory example, the bind DN for the LDAP administrator is:

        cn=admin,dc=example,dc=org

        And the password is:

        admin

4. In the LDAP searching and updating section, configure the following settings:
   • Edit mode: Select READ_ONLY. This mode restricts Keycloak from updating user information like the username and password in the LDAP directory.
   • Users DN: Enter the DN of the LDAP user tree. The users DN in LDAP identifies a user entry within an LDAP directory tree.
     In the LDAP directory example, the users DN is:

     ou=people,dc=example,dc=org

   • Username LDAP attribute: Enter the name of the LDAP attribute that is mapped as the Keycloak username.
     In the LDAP directory example, this attribute is:

     UID

   • RDN LDAP attribute: Enter the name of the LDAP attribute that is used as the RDN (top attribute) of a typical user DN.
     In the LDAP directory example, this attribute is:

     UID

   • UUID LDAP attribute: Enter the name of the LDAP attribute that is used as a unique object identifier (UUID) for objects in LDAP.
     In the LDAP directory example, this attribute is:

     UID

   • User object classes: Enter the LDAP objectClass attribute for users. If there are multiple values, separate the values by a comma.

     In the LDAP directory example, the value for this box is:

     inetOrgPerson

   • User LDAP filter: If you want to limit the users that are imported from the directory, enter a filter. You can enter a filter for individual users or a group of users. For example, in the LDAP directory example, the users Alice Smith and Dave Lee belong to the group vsp1-managers. To import these users, you could enter one of the following filters:
     • To import the individual users:

       (|(uid=alice)(uid=dave))

     • To import the users as members of the group:

       (memberOf=cn=vsp1-managers,ou=groups,dc=example,dc=org)

   • Search scope: Select one One Level (searches users DN) or Subtree (searches whole subtree).
   • Read timeout: Leave this box blank.
   • Pagination: Accept the default Off.
   • Referral: Leave this box blank.
5. In the Synchronization settings section, configure the following settings:
   • Import users: Accept the default On. This setting is required to enable user import to Keycloak
   • Sync Registrations: Set to Off.
   • Batch size: Leave this box blank.
   • Periodic full sync: Accept the default Off.
   • Periodic changed users sync: Accept the default Off.
6. In the Cache settings section, accept the default value for Cache policy.
7. In the Advanced settings section, configure the following settings:
   • Enable the LDAPv3 password modify extended operation: Accept the default Off.
   • Validate password policy: Accept the default Off.
   • Trust Email: Set the value to On.
8. Click Save.
9. (Optional) On the User federation pane, click the new provider to open the settings, and then click Actions and select Sync all users.
10. Navigate to Manage > Users to confirm that the expected user or users are shown.