Synchronize user with LDAP

🟡 Intermediate

user

osp-keycloak

This example explains how to configure LDAP user federation in OnSphere with certificate support and automatic synchronization. No downloadable configuration example is provided for this page — follow the steps below manually.

• Add the LDAP certificate (self-signed or CA-signed) to the Keycloak module configuration.

• Configure the LDAP provider via the Keycloak administration console or the federations.keycloak file.

• Enable automatic user synchronization using the Sync Settings options.

• Map LDAP attributes to Keycloak user fields and configure group mappers for rights management.

git checkout origin/osp-keycloak-configuration .

Steps

1. Add the certificate

• LDAP using a not-self signed certificate

  1. Open the /modules/keycloak/keycloak-1/module.keycloak file

• LDAP using a self signed certificate

  1. On the configuration create the certs/external folder if it doesn’t exist.

  2. Add the CA certificate as PEM into certs/external.

3. Push the new configuration.

4. Restart the Keycloak module.

2. Configure the server

• With the keycloak front-end (Recommended because it simplify the test)

  1. Access the Keycloak administration console https://{stack_ip}:{stack_port}/auth/admin (for example https://stack-1.onsphere.local:5000/auth/admin).

  2. Login to Keycloak administration console using administration user and password configured when the stack was deployed (see System security).

  3. Go the User Federation menu.

  4. Select Ldap in the Add provider menu.

  5. Fill in the required field.

  Note

  The Test the connection button only tests if the server is reachable, the certificates are not used. This is a simple ping. The Test authentication button creates a full connection with the server using provided certificate and checks if the user can be authenticated.

  

  6. The option under Sync Settings can be used to enable the automatic synchronization of users.

  

  8. Click Save

  9. A new Mappers tab has appeared a the top of the page. The mappers are used to fill in the attribute of the Keycloak users.

  Warning

  The default LDAP attribute used by the mapper might not be the one used by your LDAP. If you plan to use the group defined on the LDAP for rights, you need to create a group-ldap-mapper. If you define a Groups Path, the group must be created first.

  

  10. Once everything is working properly, you can export the configuration and integrate it to OnSphere configuration.

  • Go to the Export menu on the left and click Export

  • On the downloaded file search for org.keycloak.storage.UserStorageProvider

  • Copy the federations.

  • Open or create the /modules/keycloak/keycloak-1/federations.keycloak file

  • Add the following content if missing

    {
      "federations": []
    }
    

  • Add the copied federation to the list.

  • Remove all id to avoid any conflict.

• With the configuration file

  1. Copy osp-keycloak complete federation file.

  2. Add it’s content to the /modules/keycloak/keycloak-1/federations.keycloak file

  3. Update the file base on your LDAP configuration

  4. Push the configuration

  5. Check Keycloak logs to see if there are any errors.

  6. If necessary modify the configuration to fix the errors.

  7. Access the Keycloak administration console https://{stack_ip}:{stack_port}/auth/admin (for example https://stack-1.onsphere.local:5000/auth/admin).

  8. Login to Keycloak administration console using administration user and password configured when the stack was deployed (see System security).

  9. Check if the groups and user are properly created.