LDAP

Add LDAP User Federation Provider

Required Settings
Display name of provider when linked in admin console.
Priority of provider when doing a user lookup. Lowest first.
READ_ONLY is a read only LDAP store. WRITABLE means data will be synced back to LDAP on demand. UNSYNCED means user data will be imported, but not synced back to LDAP.
Should newly created users be created within LDAP store? Priority effects which provider is chose to sync the new user.
LDAP vendor (provider)
Name of LDAP attribute, which is mapped as Keycloak username. For many LDAP server vendors it's 'uid'. For Active directory it's usually 'sAMAccountName' or 'cn'
Name of LDAP attribute, which is used as RDN (top attribute) of typical user DN. Usually it's the same as Username LDAP attribute, however for Active directory it could be 'cn' when username attribute might be 'sAMAccountName'
Name of LDAP attribute, which is used as unique object identifier (UUID) for objects in LDAP. For many LDAP server vendors it's 'entryUUID' however some are different. For example for Active directory it should be 'objectGUID'
All values of LDAP objectClass attribute for users in LDAP divided by comma
Connection URL to your LDAP server
Full DN of LDAP tree where your users are. This DN is parent of LDAP users. It could be for example 'ou=users,dc=example,dc=com' assuming that your typical user will have DN like 'uid=john,ou=users,dc=example,dc=com'
LDAP Authentication type. Right now just 'none' (anonymous LDAP authentication) or 'simple' (Bind credential + Bind password authentication) mechanisms are available
DN of LDAP admin, which will be used by Keycloak to access LDAP server
Password of LDAP admin
For one level, we search for users just in DNs specified by User DNs. For subtree, we search in whole of their subtree. See LDAP documentation for more details
Does Keycloak should use connection pooling for accessing LDAP server
Does the LDAP server support pagination.
Useful just for Active Directory. If enabled, then Keycloak will always set Active Directory userAccountControl attribute to 512 after password update. This would mean that particular user will be enabled in Active Directory
Kerberos integration
Enable/disable HTTP authentication of users with SPNEGO/Kerberos tokens. The data about authenticated users will be provisioned from this LDAP server
Name of kerberos realm. For example FOO.ORG
Full name of server principal for HTTP service including server and domain name. For example HTTP/host.foo.org@FOO.ORG
Location of Kerberos KeyTab file containing the credentials of server principal. For example /etc/krb5.keytab
Enable/disable debug logging to standard output for Krb5LoginModule.
Use Kerberos login module for authenticate username/password against Kerberos server instead of authenticating against LDAP server with Directory Service API
Sync settings
Count of LDAP users to be imported from LDAP to Keycloak within single transaction.
Does periodic full synchronization of LDAP users to Keycloak should be enabled or not
Period for full synchronization in seconds
Does periodic synchronization of changed or newly created LDAP users to Keycloak should be enabled or not
Period for synchronization of changed or newly created LDAP users in seconds