0

Mapping Client roles of keycloak on LDAP user, like assigning realm-management roles. Can we assign realm-management client roles for users imported from LDAP in Keycloak. Changes needed in the realm.json file to allow the LDAP user to be able to access admin console. (User management & view realm)

We are trying to set up LDAP based user federation using by importing a realm.json, configured with LDAP related configuration, but don't know the configuration needed to be made in realm.json to assign realm-management client roles like view-users, view-clients and manage-realm

//snippet of realm.json:
{
      "realm": "insight-engine",
      "enabled": true,
      "sslRequired": "external",
      "registrationAllowed": false,
      ...... some more configuration
      "requiredCredentials": [ "password" ],
      "roles" : {
        "realm" : [
        {
          "name": "user",
          "description": "User privileges"
        },
        {
          "name": "admin",
          "description": "Administrator privileges"
        }
        ]
      },
      "scopeMappings": [
      {
        "client": "js-console",
        "roles": ["user"]
      },
      {
        "client": "angular1",
        "roles": ["user"]
      }
      ],
      "clients": [
      {
        "clientId": "js-console",
        "enabled": true,
        "publicClient": true,
        "baseUrl": "/js-console",
        "redirectUris": [
          "/js-console/*"
        ],
        "webOrigins": []
      },
      {
        "clientId": "angular1",
        "enabled": true,
        "publicClient": true,
        "baseUrl": "/",
        "redirectUris": [
          "*"
        ],
        "webOrigins": []
      }
      ],
      "userFederationProviders": [
        {
          "displayName": "ldap",
          "providerName": "ldap",
          "priority": 1,
          "fullSyncPeriod": -1,
          "changedSyncPeriod": -1,
          "config": {
            "pagination" : "true",
            "debug" : "false",
            "searchScope" : "1",
            "connectionPooling" : "true",
            "usersDn" : "ou=People,dc=insight,dc=engine",
            "userObjectClasses" : "inetOrgPerson, organizationalPerson",
            "usernameLDAPAttribute" : "uid",
            "bindDn" : "cn=Administrator,dc=insight,dc=engine",
            "bindCredential" : "Cisco#321",
            "rdnLDAPAttribute" : "uid",
            "vendor" : "other",
            "editMode" : "WRITABLE",
            "uuidLDAPAttribute" : "entryUUID",
            "connectionUrl" : "ldap://ldap-external-service:389",
            "syncRegistrations" : "true",
            "authType" : "simple"
          }
        }
      ],
      "userFederationMappers" : [
        {
          "name" : "username",
          "federationMapperType" : "user-attribute-ldap-mapper",
          "federationProviderDisplayName" : "ldap-apacheds",
          "config" : {
            "ldap.attribute" : "uid",
            "user.model.attribute" : "username",
            "is.mandatory.in.ldap" : "true",
            "read.only" : "false",
            "always.read.value.from.ldap" : "false"
          }
        },
        {
          "name" : "first name",
          "federationMapperType" : "user-attribute-ldap-mapper",
          "federationProviderDisplayName" : "ldap-apacheds",
          "config" : {
            "ldap.attribute" : "cn",
            "user.model.attribute" : "firstName",
            "is.mandatory.in.ldap" : "true",
            "read.only" : "false",
            "always.read.value.from.ldap" : "false"
          }
        },
        {
          "name" : "creation date",
          "federationMapperType" : "user-attribute-ldap-mapper",
          "federationProviderDisplayName" : "ldap-apacheds",
          "config" : {
            "ldap.attribute" : "createTimestamp",
            "user.model.attribute" : "createTimestamp",
            "is.mandatory.in.ldap" : "false",
            "read.only" : "true",
            "always.read.value.from.ldap" : "false"
          }
        },
        {
          "name" : "modify date",
          "federationMapperType" : "user-attribute-ldap-mapper",
          "federationProviderDisplayName" : "ldap-apacheds",
          "config" : {
            "ldap.attribute" : "modifyTimestamp",
            "user.model.attribute" : "modifyTimestamp",
            "is.mandatory.in.ldap" : "false",
            "read.only" : "true",
            "always.read.value.from.ldap" : "false"
          }
        },
        {
          "name" : "realm roles",
          "federationMapperType" : "role-ldap-mapper",
          "federationProviderDisplayName" : "ldap-apacheds",
          "config" : {
            "roles.dn" : "ou=RealmRoles,dc=keycloak,dc=org",
            "membership.ldap.attribute" : "member",
            "role.name.ldap.attribute" : "cn",
            "role.object.classes" : "groupOfNames",
            "mode" : "LDAP_ONLY",
            "use.realm.roles.mapping" : "true"
          }
        },
        {
          "name" : "finance roles",
          "federationMapperType" : "role-ldap-mapper",
          "federationProviderDisplayName" : "ldap-apacheds",
          "config" : {
            "roles.dn" : "ou=FinanceRoles,dc=keycloak,dc=org",
            "membership.ldap.attribute" : "member",
            "role.name.ldap.attribute" : "cn",
            "role.object.classes" : "groupOfNames",
            "mode" : "LDAP_ONLY",
            "use.realm.roles.mapping" : "false",
            "client.id" : "finance"
          }
        }
      ],
      "clientScopeMappings": {
        "account": [
        {
          "client": "angular",
          "roles": ["view-profile"]
        }
        ],
        "realm-management": [
        {
          "client": "angular",
          "roles": ["manage-realm", "manage-users", "manage-clients"]
        }
        ]
      }
    }

Basically the requirement is when we login to the client using the LDAP credentials, the user should be able to access user-management and view-realm client(i.e accessing the admin console) from client side.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.