LDAP User Federation Provider {{instance.displayName|capitalize}}

Add LDAP User Federation Provider

Required Settings
Display name of provider when linked in admin console.
Priority of provider when doing a user lookup. Lowest first.
READ_ONLY is a read only LDAP store. WRITABLE means data will be synced back to LDAP on demand. UNSYNCED means user data will be imported, but not synced back to LDAP.
Should newly created users be created within LDAP store? Priority effects which provider is chose to sync the new user.
LDAP vendor (provider)
Name of LDAP attribute, which is mapped as Keycloak username. For many LDAP server vendors it's 'uid'. For Active directory it's usually 'sAMAccountName' or 'cn'
All values of LDAP objectClass attribute for users in LDAP divided by comma
Connection URL to your LDAP server
Base DN of LDAP tree where your data are. Base DN is usually ancestor of User DN Suffix
Base DN of LDAP tree where your users are. This DN is parent of all DNs of LDAP users
DN of LDAP admin, which will be used by Keycloak to access LDAP server
Password of LDAP admin
Does Keycloak should use connection pooling for accessing LDAP server
Does the LDAP server support pagination.
Useful just for Active Directory. If enabled, then Keycloak will always set Active Directory userAccountControl attribute to 512 after password update. This would mean that particular user will be enabled in Active Directory
Kerberos integration
Enable/disable HTTP authentication of users with SPNEGO/Kerberos tokens. The data about authenticated users will be provisioned from this LDAP server
Name of kerberos realm. For example FOO.ORG
Full name of server principal for HTTP service including server and domain name. For example HTTP/host.foo.org@FOO.ORG
Location of Kerberos KeyTab file containing the credentials of server principal. For example /etc/krb5.keytab
Enable/disable debug logging to standard output for Krb5LoginModule.
Use Kerberos login module for authenticate username/password against Kerberos server instead of authenticating against LDAP server with Directory Service API
Sync settings
Count of LDAP users to be imported from LDAP to Keycloak within single transaction.
Does periodic full synchronization of LDAP users to Keycloak should be enabled or not
Period for full synchronization in seconds
Does periodic synchronization of changed or newly created LDAP users to Keycloak should be enabled or not
Period for synchronization of changed or newly created LDAP users in seconds