Re: [keycloak-user] LDAP Authentication - Extended Errors
On 07/08/18 22:47, Mark Hunt wrote:
Hi,
I have been doing some development with Keycloak and specifically OpenID Connect,
Password Grant and an LDAP user federation with Active Directory. Overall everything is
working great but I am a little surprised that on a token refresh I get told that the user
account is disabled but on a login I do not. The exception to this would be if I try to
login with a disabled account after a user federation sync has occurred.
Is this a configuration issue or do you need to implement LDAP diagnostic messages for
login?
Not sure I understand. If you go to the admin console, are you seeing
the user is enabled or disabled here? Is user enabled or disabled in MSAD?
One thing to note is, that if you disabled the user directly in MSAD
after it was already synced to Keycloak, the user may be cached in the
Keycloak. So there may be some time needed until the latest information
about enabled/disabled state is propagated from MSAD to the Keycloak
side. You can try to clear the cache to check if it's the case. For long
term, you can tweak caching policy configuration of LDAP provider.
Marek
Thanks for developing a fantastic product!!
Regards
Mark
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user