3:04 a.m.
We don't have OOTB support for this usecase. AFAIK JIRAs still exists to
improve this.
You may need to create new Authenticator implementation and add it to
first broker login flow, which will automatically ends with "success" in
case that existing user is a user from your LDAP.
Marek
On 20/06/17 14:13, Marc Jadoul wrote:
Hello,
I am trying to configure RH SSO 7.0 (available as container in Openshift
V3.2), to obtain attributes and roles from a read-only LDAP.
User are authenticated using SAML, but applications do need additional
attributes.
The LDAP server has those attributes but do not provide user
authentication, which is provided by Kerberos or SAML.
Kerberos + LDAP is not really an option as it authenticate only a part of
the users of the organization while SAML + LDAP could works for all.
I found a couple of related issues:
https://issues.jboss.org/browse/KEYCLOAK-4171
But solutions proposed does not work for me.... May be because my LDAP does
not allows authentication?
I get this error:
09:13:07,510 WARN [org.keycloak.events] (default task-320)
type=IDENTITY_PROVIDER_FIRST_LOGIN_ERROR, realmId=DevRealm, clientId=
http://testapp.example.corp/mellon/metadata, userId=null,
ipAddress=10.0.0.20, error=invalid_user_credentials,
identity_provider=hub-i-saml2, auth_method=saml, redirect_uri=
http://testapp.example.corp/mellon/postResponse,
identity_provider_identity=testuser,
code_id=...
Or this one (if in first login I allows user re-authentication) but then I
am prompted for a password which fail authenticating as the LDAP does not
know my password.
09:13:07,510 WARN [org.keycloak.events] (default task-320)
type=IDENTITY_PROVIDER_FIRST_LOGIN_ERROR, realmId=DevRealm, clientId=
http://testapp.example.corp/mellon/metadata,
userId=fa84a028-e28f-4d06-a72f-aad9c51d88f2,
ipAddress=10.0.0.20, error=invalid_user_credentials,
identity_provider=hub-i-saml2, auth_method=saml, redirect_uri=
http://testapp.example.corp/mellon/postResponse,
identity_provider_identity=testuser,
code_id=...
Is there a solution out of the box for my use case? Adding additional
information about users from an ldap connection, read-only and without
re-authentication?
Regards,
Marc
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user