<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Hi,
<div class=""><br class="">
</div>
<div class="">I would like to use the Full Name User Federation Mapper to set the CN attribute in Active Directory from Keycloak. If I am not mistaken this is currently not possible in Keycloak because on creation of the user the only thing that is available
is the username and no other user attributes (see UserFederationManager#addUser(RealmModel realm, String username).</div>
<div class=""><br class="">
</div>
<div class="">Since the CN is mandatory it needs to be set during creation of the user object in AD (and in any LDAP server). With our current configuration with the Full Name mapper enabled and configured to map to the CN attribute we cannot create users
from Keycloak since the full name (as well as the first and last name) and hence the CN are still empty on user creation:</div>
<div class=""><br class="">
</div>
<div class="">
<table cellspacing="0" cellpadding="0" border="0" width="100%" style="font-family: Arial, sans-serif; font-size: 1em; widows: 1; color: black; background-color: rgb(245, 245, 245); line-height: 1.4em !important;" class="">
<tbody class="">
<tr id="syntaxplugin_code_and_gutter" class="">
<td style="padding: 0em; vertical-align: top; line-height: 1.4em !important;" class="">
<pre style="margin: 10px 10px 0px; padding: 0px; font-size: 1em; width: auto;" class=""><span style="font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important;" class="">10:03:56,246 ERROR [org.keycloak.services.resources.ModelExceptionMapper] (default task-5) Error creating subcontext [cn= ,ou=Customers,dc=hf,dc=info,dc=nl]: org.keycloak.models.ModelException: Error creating subcontext [cn= ,ou=Customers,dc=hf,dc=info,dc=nl]</span></pre>
</td>
</tr>
<tr id="syntaxplugin_code_and_gutter" class="">
<td style="padding: 0em; vertical-align: top; line-height: 1.4em !important;" class="">
<pre style="margin: 0px 10px; padding: 0px; font-size: 1em; width: auto;" class=""><span style="font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important;" class=""> at org.keycloak.federation.ldap.idm.store.ldap.LDAPOperationManager.createSubContext(LDAPOperationManager.java:425)</span></pre>
</td>
</tr>
<tr id="syntaxplugin_code_and_gutter" class="">
<td style="padding: 0em; vertical-align: top; line-height: 1.4em !important;" class="">
<pre style="margin: 0px 10px; padding: 0px; font-size: 1em; width: auto;" class=""><span style="font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important;" class=""> at org.keycloak.federation.ldap.idm.store.ldap.LDAPIdentityStore.add(LDAPIdentityStore.java:75)</span></pre>
</td>
</tr>
<tr id="syntaxplugin_code_and_gutter" class="">
<td style="padding: 0em; vertical-align: top; line-height: 1.4em !important;" class="">
<pre style="margin: 0px 10px; padding: 0px; font-size: 1em; width: auto;" class=""><span style="font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important;" class=""> at org.keycloak.federation.ldap.LDAPUtils.addUserToLDAP(LDAPUtils.java:50)</span></pre>
</td>
</tr>
<tr id="syntaxplugin_code_and_gutter" class="">
<td style="padding: 0em; vertical-align: top; line-height: 1.4em !important;" class="">
<pre style="margin: 0px 10px; padding: 0px; font-size: 1em; width: auto;" class=""><span style="font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important;" class=""> at org.keycloak.federation.ldap.LDAPFederationProvider.register(LDAPFederationProvider.java:154)</span></pre>
</td>
</tr>
<tr id="syntaxplugin_code_and_gutter" class="">
<td style="padding: 0em; vertical-align: top; line-height: 1.4em !important;" class="">
<pre style="margin: 0px 10px; padding: 0px; font-size: 1em; width: auto;" class=""><span style="font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important;" class=""> at org.keycloak.models.UserFederationManager.registerWithFederation(UserFederationManager.java:56)</span></pre>
</td>
</tr>
<tr id="syntaxplugin_code_and_gutter" class="">
<td style="padding: 0em; vertical-align: top; line-height: 1.4em !important;" class="">
<pre style="margin: 0px 10px; padding: 0px; font-size: 1em; width: auto;" class=""><span style="font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important;" class=""> at org.keycloak.models.UserFederationManager.addUser(UserFederationManager.java:48)</span></pre>
</td>
</tr>
<tr id="syntaxplugin_code_and_gutter" class="">
<td style="padding: 0em; vertical-align: top; line-height: 1.4em !important;" class="">
<pre style="margin: 0px 10px; padding: 0px; font-size: 1em; width: auto;" class=""><span style="font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important;" class=""> at org.keycloak.services.resources.admin.UsersResource.createUser(UsersResource.java:190)</span></pre>
</td>
</tr>
</tbody>
</table>
<div class=""><br class="">
</div>
</div>
<div class=""><br class="">
</div>
<div class="">If I am not mistaken the way Keycloak creates users is by first creating an ‘empty’ user with only the username set and after that the user is updated with all user attributes like firstname, last name, email etc.</div>
<div class=""><br class="">
</div>
<div class="">The only workaround we can find is to add an attribute mapper that maps the Keycloak username field to the CN LDAP/AD attribute. This works ok but it different from how AD treats the CN which is as the full name and not the user name.</div>
<div class=""><br class="">
</div>
<div class="">Shall I create a JIRA issue for this?</div>
<div class=""><br class="">
</div>
<div class="">cheers</div>
</body>
</html>