Re: [keycloak-user] [KeyCloak] - LDAP Query

Hi, On 25/10/18 08:31, Vivek Aggarwal wrote: Keycloak itself is not LDAP server. However Keycloak can be integrated with the LDAP server, so that Keycloak uses LDAP server to authenticate users. With that in mind, I think you can indirectly achieve what you want. You just need to integrate Keycloak with the LDAP and configure it with editMode WRITABLE. And you will integrate same LDAP for your linux/SSH authentication. This means that if you create new user in Keycloak, this user will be propagated to the LDAP and so he can also authenticate to SSH/Linux through the usage of same LDAP server like Keycloak is using. I guess you integrated jenkins to use Keycloak for authentication. In that case, you can either: - Manage users just through the Keycloak console and never from jenkins console. The updates from Keycloak will be propagated to LDAP. So this way, it will ensure that users will be able to authenticate to jenkins and jenkins will see latest user profile info from Keycloak/LDAP - Manage users through the Jenkins. I assume your Jenkins will write users to LDAP then. In Keycloak, you will then also see the updated user as Keycloak uses LDAP as a source of the info. However you may need to adjust caching policies on Keycloak side due to this to see the updates on Keycloak side immediatelly (see docs for more details). So maybe I would personally prefer the option 1 if possible. Marek