Hello all,
I have an issue configuring both systems Keycloak and FreeIPA to work with
User Federation. Configuration on Keycloak side for the ldap (FreeIPA
server) is as follows:
- LDAPs configuration
- Keytab from FreeIPA generated with admin user
The below screenshot is from the Keycloak User Federation:
[image: image.png]
[image: image.png]
Importing users works flawlessly but the problems comes when I try to
create user in Keycloak and expect it to be created on FreeIPA side -
WRITABLE is on, and keycloak machine is enrolled into FreeIPA as a client
(both OSes are Alma). There is no error, and Keycloak indicates that a new
user is created.
However, in FreeIPA's web interface the user is missing and the most
frustrating thing is if i try to create the very same username, FreeIPA
returns that it can't add the user, because it already *exists*. I guess
the issue would be somewhere either in Username/RDN LDAP attribute or UUID
or even Custom User LDAP filter, but i'm lost a bit.
In case someone wants to help here what i've tried to play with:
- Setting UUID Ldap attribute to ipaUniqueID, but using it, returns 0
user when trying to sync, and creating user from Keycloak returns error
- Setting custom ldap filter to match a group from the LDAP - no binding
with admin user could be achieved, thus no user could be synced
Anyhelp on this will be much appreciated :")
Thank you in advance