[keycloak-user] Handling disabled users from LDAP

[Michael Ströder]

Dockendorf, Trey wrote:
> With either approach it sounds like what your describing is getting
> the loginDisabled attribute into Keycloak.  Once that attribute is
> stored, how would I go about telling Keycloak to disallow access
> based on the attribute's value?

With OpenLDAP's ACLs you should grant auth access to 'userPassword' for
anonymous based on value of your custom loginDisabled attribute. With
such an ACL keycloak does not have to know about that attribute at all.
And all LDAP-enabled applications will behave the same without
reconfiguration.

OpenLDAP details are off-topic here.
You could ask for ACL details on the openldap-technical mailing list.

Ciao, Michael.