<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Hello,<br>
<br>
It's possible to sync roles to/from LDAP with usage of role mapper
and groups with usage of group mapper. However ATM it's not
possible to map the group-role membership from LDAP into Keycloak.
<br>
<br>
For example if you have role mapper configured for roles from
"ou=roles,dc=example,dc=com" and you have groups mapper for groups
from "ou=groups,dc=example,dc=com" . Then you have LDAP group
"cn=group1,ou=groups,dc=example,dc=com" which has member
"cn=role1,ou=roles,dc=example,dc=com" . Then in keycloak you won't
see that group "group1" has role "role1" as it's member.<br>
<br>
If you have MSAD, you can use "User Roles Retrieve Strategy" value
"LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY" and then the role of
user will be visible in Keycloak even if it's available just
recursively. For example "cn=role1,ou=roles,dc=example,dc=com" has
member "cn=group1,ou=groups,dc=example,dc=com" and the
"cn=group1,ou=groups,dc=example,dc=com" has member
"cn=myuser,ou=users,dc=example,dc=com" . then in keycloak you will
see that user "myuser" is member of "role1". <br>
<br>
It will be good to support groups-roles relationship though, feel
free to create JIRA for that and add your usecase (ideally with
some example snippet of your LDAP tree and how exactly you want
membership relationship to be visible in Keycloak based on
mappings from your LDAP)<br>
<br>
Thanks,<br>
Marek<br>
<br>
<br>
On 24/05/16 13:07, Harits Elfahmi wrote:<br>
</div>
<blockquote
cite="mid:CAG_KPw1KZLG0Wrik9RBYihg+Vu2WR3Mzdy8BiD9KxJZScNASqA@mail.gmail.com"
type="cite">
<div dir="ltr">Hello guys,
<div><br>
</div>
<div>We're trying to sync roles and groups from LDAP to Keycloak
and vice versa. <br clear="all">
<div>If we attach some keycloak roles to a group, can this
association be synced back to LDAP? How should I config my
User Federation Mapper for Group mapper? </div>
<div><br>
</div>
<div>From what I understand we can set the Membership LDAP
Attribute, but I think this is to associate between groups
and users, not groups and roles. Is it possible to do this,
or is the group-roles association can only be configured
from keycloak?</div>
<div><br>
</div>
<div>Thanks</div>
-- <br>
<div class="gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<div>Cheers,</div>
<div><b><br>
</b></div>
<div><b>Harits</b> Elfahmi</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
keycloak-user mailing list
<a class="moz-txt-link-abbreviated" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>
<a class="moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a></pre>
</blockquote>
<br>
</body>
</html>