Mapping LDAP groups to Keycloak groups

You can map and synchronize user groups in an LDAP directory to a local group in Keycloak. When you map a group, a group is created in Keycloak and all users in the group inherit the role assigned to the group.

1. Create a group in Keycloak to which you will map the LDAP group by completing the following steps.
   1. Navigate to Manage > Groups.
   2. Click Create group, enter the group name, and then click Create.
   3. Configure the group, and click Save.
2. Map the group to a role by completing the following steps:
   1. On the Groups pane, click the new group.
   2. Click the Role mapping tab.
   3. From the Assign role drop-down, select Client roles or Realm roles. The available roles are shown based on your selection.
   4. Select the role or roles that you want to assign to the group, and then click Assign.
3. Configure the mapper information for the LDAP group by completing the following steps:
   1. Navigate to Configure > User federation.
   2. On the User federation pane, select the LDAP provider that contains the group that you want to add.
   3. On the settings pane for the provider, click the Mappers tab, and then click Add mapper.
   4. In the Create new mapper pane, complete the following setings to map LDAP groups to Keycloak:
      • Name: Enter a name for the mapper.
      • Mapper type: Select group-ldap-mapper.
      • LDAP Groups DN: Enter the DN where the LDAP groups are stored.

        In the LDAP directory example, the groups DN is:

        ou=groups,dc=example,dc=org

      • Group Name LDAP Attribute: Accept the default cn.
      • Group Object Classes: Enter the LDAP objectClass attribute for groups. If there are multiple values, separate the values by a comma.

        In the LDAP directory example, the value for this box is:

        groupOfNames

      • Preserve Group Inheritance: Set this option to Off to prevent group inheritance across nested groups in LDAP.
      • Ignore Missing Groups: Accept the default On to ignore groups that might be missing or unavailable during synchronization.
      • Membership LDAP Attribute: Accept the default member, which will reference the attribute in LDAP that lists group members.
      • Membership Attribute Type: Accept the default DN to indicate that members are represented by their Distinguished Name in LDAP
      • Membership User LDAP Attribute: Enter uid, which represents the user identifier in LDAP.
      • LDAP Filter: If you want to limit the group or groups that you want to map, enter a filter. For example, to map the group vsp1-managers from the LDAP directory example, enter the filter:

        (distinguishedName=cn=vsp1-managers,ou=groups,dc=example,dc=org)

      • Mode: Select READ_ONLY.
      • User Groups Retrieve Strategy: Accept the default LOAD_GROUPS_BY_MEMBER_ATTRIBUTE.
      • Member-Of LDAP Attribute: Accept the default memberOf.
      • Mapped Group Attributes: Leave this box blank.
      • Drop Non-Existing Groups During Sync: Accept the default Off.
      • Groups Path: Default / places users at the root of Keycloak groups. To nest users in a pre-created group, specify its full path. For example, if you created a group named LDAP, enter the path /LDAP.
   5. Click the Save.
4. On the User federation pane, click the provider to open the settings, and then click Actions and select Sync all users.
5. Verify that LDAP users are shown as members of the local group by completing the following steps:
   1. Navigate to Manage > Groups and select the new group.
   2. Click the Members tab and verify that the LDAP users are shown in the group.
6. Verify that you can log on to the VSP One File management software as a user in the new Keycloak role.