Skip to content

Authenticate KeyCloak against OpenLDAP

Warning

This is not a complete recipe - it's an optional component of the Keycloak recipe, but has been split into its own page to reduce complexity.

KeyCloak gets really sexy when you integrate it into your OpenLDAP stack (also, it's great not to have to play with ugly LDAP tree UIs). Note that OpenLDAP integration is not necessary if you want to use KeyCloak with Traefik Forward Auth - all you need for that is local users, and an OIDC client.

Ingredients

Summary

Existing:

New:

Preparation

You'll need to have completed the OpenLDAP recipe

You start in the "Master" realm - but mouseover the realm name, to a dropdown box allowing you add an new realm:

Create Realm

KeyCloak Add Realm Screenshot

Enter a name for your new realm, and click "Create":

KeyCloak Add Realm Screenshot

Setup User Federation

Once in the desired realm, click on User Federation, and click Add Provider. On the next page ("Required Settings"), set the following:

  • Edit Mode : Writeable
  • Vendor : Other
  • Connection URL : ldap://openldap
  • Users DN : ou=People,<your base DN>
  • Authentication Type : simple
  • Bind DN : cn=admin,<your base DN>
  • Bind Credential : <your chosen admin password>

Save your changes, and then navigate back to "User Federation" > Your LDAP name > Mappers:

KeyCloak Add Realm Screenshot

For each of the following mappers, click the name, and set the "Read Only" flag to "Off" (this enables 2-way sync between KeyCloak and OpenLDAP)

  • last name
  • username
  • email
  • first name

KeyCloak Add Realm Screenshot

Summary

We've setup a new realm in KeyCloak, and configured read-write federation to an OpenLDAP backend. We can now manage our LDAP users using either KeyCloak or LDAP directly, and we can protect vulnerable services using Traefik Forward Auth.

Summary

Created:

  • KeyCloak realm in read-write federation with OpenLDAP directory

Chef's Notes 📓

Tip your waiter (support me) 👏

Did you receive excellent service? Want to make your waiter happy? (..and support development of current and future recipes!) See the support page for (free or paid) ways to say thank you! 👏

Flirt with waiter (subscribe) 💌

Want to know now when this recipe gets updated, or when future recipes are added? Subscribe to the RSS feed, or leave your email address below, and we'll keep you updated. (double-opt-in, no monkey business, no spam either - check the archive for proof!)

Your comments? 💬