freeIPA federation with keycloak

[Vincent Bartro]

Hello all,

we are investigating the various options to create a federation between
keycloak and freeIPA, where freeIPA is the central IdM.
There seems to be two major options for such a federation :
- have keycloak talk LDAPS to freeIPA
- have keycloak talk Kerberos to freeIPA

I could not find a clear and objective list of criteria to decide to pick
one option over the other

Did anybody already experience any of these two approached and could share
their experience?

Thanks a lot in advance

Best regards

[Alexander Bokovoy]

See ipa-tuura.
FOSDEM talk:
https://archive.fosdem.org/2024/schedule/event/fosdem-2024-2618-ipa-tuura-fr...
Project: https://github.com/freeipa/ipa-tuura/

Keycloak plugin is part of keycloak 26.

[Jochen Kellner]

Hello Vincent,

Vincent Bartro via FreeIPA-users 
writes:
> we are investigating the various options to create a federation between
> keycloak and freeIPA, where freeIPA is the central IdM.
> There seems to be two major options for such a federation :
> have keycloak talk LDAPS to freeIPA
> have keycloak talk Kerberos to freeIPA
>
> I could not find a clear and objective list of criteria to decide to pick
> one option over the other

I do use the LDAP provider and have enabled
allowKerberosAuthentication. That way you can get "all" ldap attributes
and have the opportunity to do kerberos SSO. Seems to work pretty well
here (small home lab).

Jochen

[Lars Kagrath]

Hello Vincent,

we use LDAP provider - currently with disabled 
allowKerberosAuthentication.
This works very well with different Linux systems for SSO.

best regards

Lars

Am 2025-12-19 16:09, schrieb Jochen Kellner via FreeIPA-users:
> Hello Vincent,
>
> Vincent Bartro via FreeIPA-users 
> writes:
> > we are investigating the various options to create a federation 
> > between
> > keycloak and freeIPA, where freeIPA is the central IdM.
> > There seems to be two major options for such a federation :
> > have keycloak talk LDAPS to freeIPA
> > have keycloak talk Kerberos to freeIPA
> >
> > I could not find a clear and objective list of criteria to decide to 
> > pick
> > one option over the other
>
> I do use the LDAP provider and have enabled
> allowKerberosAuthentication. That way you can get "all" ldap attributes
> and have the opportunity to do kerberos SSO. Seems to work pretty well
> here (small home lab).
>
> Jochen
>
> --
> This space is intentionally left blank.