Important: The information in this topic is based on openLDAP and is for example purposes only. If you are using another LDAP provider such as Active Directory, your environment will differ.
To add users in Keycloak through integration with an LDAP directory, you must provide information that is found in the directory. You can query the directory to view the directory contents as shown in the following example. This example shows an openLDAP directory
"ldapsearch -x -D "cn=admin,dc=example,dc=org" -w admin -b "dc=example,dc=org""
Where:
- ldapsearch: Specifies a tool to search the LDAP directory.
- -x: Specifies simple authentication.
- -D "cn=admin,dc=example,dc=org": Specifies the distinguished name of the admin user.
- -w admin: Specifies the password for the admin user.
- -b "dc=example,dc=org": Specifies the base DN to start the search from.
For example purposes, assume that the query returns the following contents:
# extended LDIF # # LDAPv3 # base <dc=example,dc=org> with scope subtree # filter: (objectclass=*) # requesting: ALL # # example.org dn: dc=example,dc=org objectClass: top objectClass: dcObject objectClass: organization o: Example Inc. dc: example # people, example.org dn: ou=people,dc=example,dc=org objectClass: organizationalUnit ou: people # groups, example.org dn: ou=groups,dc=example,dc=org objectClass: organizationalUnit ou: groups # john, people, example.org dn: uid=john,ou=people,dc=example,dc=org objectClass: inetOrgPerson cn: John Doe sn: Doe uid: john mail: john@example.org userPassword:: cGFzc3dvcmQxMjM= # alice, people, example.org dn: uid=alice,ou=people,dc=example,dc=org objectClass: inetOrgPerson cn: Alice Smith sn: Smith uid: alice mail: alice@example.org userPassword:: cGFzc3dvcmQxMjM= # bob, people, example.org dn: uid=bob,ou=people,dc=example,dc=org objectClass: inetOrgPerson cn: Bob Johnson sn: Johnson uid: bob mail: bob@example.org userPassword:: cGFzc3dvcmQxMjM= # eve, people, example.org dn: uid=eve,ou=people,dc=example,dc=org objectClass: inetOrgPerson cn: Eve Adams sn: Adams uid: eve mail: eve@example.org userPassword:: cGFzc3dvcmQxMjM= # carol, people, example.org dn: uid=carol,ou=people,dc=example,dc=org objectClass: inetOrgPerson cn: Carol Martinez sn: Martinez uid: carol mail: carol@example.org userPassword:: cGFzc3dvcmQxMjM= # dave, people, example.org dn: uid=dave,ou=people,dc=example,dc=org objectClass: inetOrgPerson cn: Dave Lee sn: Lee uid: dave mail: dave@example.org userPassword:: cGFzc3dvcmQxMjM= # frank, people, example.org dn: uid=frank,ou=people,dc=example,dc=org objectClass: inetOrgPerson cn: Frank Wright sn: Wright uid: frank mail: frank@example.org userPassword:: cGFzc3dvcmQxMjM= # grace, people, example.org dn: uid=grace,ou=people,dc=example,dc=org objectClass: inetOrgPerson cn: Grace Kim sn: Kim uid: grace mail: grace@example.org userPassword:: cGFzc3dvcmQxMjM= # developers, groups, example.org dn: cn=developers,ou=groups,dc=example,dc=org objectClass: groupOfNames cn: developers member: uid=eve,ou=people,dc=example,dc=org member: uid=grace,ou=people,dc=example,dc=org # managers, groups, example.org dn: cn=managers,ou=groups,dc=example,dc=org objectClass: groupOfNames cn: managers member: uid=dave,ou=people,dc=example,dc=org # vsp1-managers, groups, example.org dn: cn=vsp1-managers,ou=groups,dc=example,dc=org objectClass: groupOfNames cn: vsp1-managers member: uid=alice,ou=people,dc=example,dc=org member: uid=dave,ou=people,dc=example,dc=org # search result search: 2 result: 0 Success # numResponses: 15 # numEntries: 14
In the preceding example LDAP directory, the information in bold is required to configure these settings in Keycloak:
- Users DN: ou=people,dc=example,dc=org
- Username LDAP attribute, RDNLDAP attribute, and UUID LDAP attribute: uid
- User object classes: inetOrgPerson
- LDAP Groups DN: ou=groups,dc=example,dc=org
- Group Object Classes: groupOfNames
The individual user and group information in the LDAP directory is also used to configure user information in Keycloak.