Re: [keycloak-user] Retrieve Roles-Groups association from LDAP

Hello, It's possible to sync roles to/from LDAP with usage of role mapper and groups with usage of group mapper. However ATM it's not possible to map the group-role membership from LDAP into Keycloak. For example if you have role mapper configured for roles from "ou=roles,dc=example,dc=com" and you have groups mapper for groups from "ou=groups,dc=example,dc=com" . Then you have LDAP group "cn=group1,ou=groups,dc=example,dc=com" which has member "cn=role1,ou=roles,dc=example,dc=com" . Then in keycloak you won't see that group "group1" has role "role1" as it's member. If you have MSAD, you can use "User Roles Retrieve Strategy" value "LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY" and then the role of user will be visible in Keycloak even if it's available just recursively. For example "cn=role1,ou=roles,dc=example,dc=com" has member "cn=group1,ou=groups,dc=example,dc=com" and the "cn=group1,ou=groups,dc=example,dc=com" has member "cn=myuser,ou=users,dc=example,dc=com" . then in keycloak you will see that user "myuser" is member of "role1". It will be good to support groups-roles relationship though, feel free to create JIRA for that and add your usecase (ideally with some example snippet of your LDAP tree and how exactly you want membership relationship to be visible in Keycloak based on mappings from your LDAP) Thanks, Marek On 24/05/16 13:07, Harits Elfahmi wrote: