It's possible to sync roles to/from LDAP with usage of role mapper and
groups with usage of group mapper. However ATM it's not possible to map
the group-role membership from LDAP into Keycloak.
For example if you have role mapper configured for roles from
"ou=roles,dc=example,dc=com" and you have groups mapper for groups from
"ou=groups,dc=example,dc=com" . Then you have LDAP group
"cn=group1,ou=groups,dc=example,dc=com" which has member
"cn=role1,ou=roles,dc=example,dc=com" . Then in keycloak you won't see
that group "group1" has role "role1" as it's member.
If you have MSAD, you can use "User Roles Retrieve Strategy" value
"LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY" and then the role of user
will be visible in Keycloak even if it's available just recursively. For
example "cn=role1,ou=roles,dc=example,dc=com" has member
"cn=group1,ou=groups,dc=example,dc=com" and the
"cn=group1,ou=groups,dc=example,dc=com" has member
"cn=myuser,ou=users,dc=example,dc=com" . then in keycloak you will see
that user "myuser" is member of "role1".
It will be good to support groups-roles relationship though, feel free
to create JIRA for that and add your usecase (ideally with some example
snippet of your LDAP tree and how exactly you want membership
relationship to be visible in Keycloak based on mappings from your LDAP)
On 24/05/16 13:07, Harits Elfahmi wrote:
We're trying to sync roles and groups from LDAP to Keycloak and vice
If we attach some keycloak roles to a group, can this association be
synced back to LDAP? How should I config my User Federation Mapper for
From what I understand we can set the Membership LDAP Attribute, but I
think this is to associate between groups and users, not groups and
roles. Is it possible to do this, or is the group-roles association
can only be configured from keycloak?
keycloak-user mailing list