Hi, We’re trying to connect keycloak to ldap over ssl. We followed keycloak documentation from this link and this link for adding the spi standalone.xml as can be seen below. There’s no problem on testing the connection url but it is failing on testing authentication. The seen error from the logs i…

Hi, Generally, the error indicates that LDAP server certificate is not imported into truststore in Keycloak. Best Regards, Taro

You say that “There’s no problem on testing the connection url but it is failing on testing authentication” Are you sure that connection url starts with “ldaps:”?

i have the same problem. in my case, yes. im using keycloak “jboss/keycloak” with docker compose. when testing connection to ldaps://contoso.local:636 it connects OK, but at “test authentication” using a domain-admin user, i got an error Error! LDAP authentication failed. See server.log for d…

@ema07cqc what worked for me was, I copied my Certs from my CA (which was on my MSAD), then added them to my java keystore (cacerts) on my CentOS 7 machine. I did try creating my own keystore, but for some reason ansible failed to use it. It might have something to do with my Nginx reverse proxy. …

[image] gsmith: java keystore (cacerts) Thanks, i will search for adding certs to java keystore (cacerts). I have 3 Domain Controllers… i can use any CA from any of them? thanks again and have a nice weekend!

[image] ema07cqc: Thanks, i will search for adding certs to java keystore (cacerts). I have 3 Domain Controllers… i can use any CA from any of them? thanks again and have a nice weekend! An interesting point here. Certificate validation is about validating that an server certificate is kno…

Thanks for your reply. Im still trying to figure out how to make this works. :point_right: CONTOSO is my domain Im trying to connect a Keycloak Realm to LDAPS. LDAP works just fine, but LDAPS not. created a CA.crt and imported to all my DCs tested CA.crt the LDAPS connection with openssl an…

“Could not negotiate TLS” appears to be other problem… There are any ‘PKIX’ messages on log? It works if you add cert to java cacerts?

Connect keycloak to LDAP over SSL

Configuring the server

gsmith April 24, 2020, 10:29pm 9

@ema07cqc
I believe you can, which ever one you are using for authentication in the realm.

Topic		Replies	Views
LDAP authentication over SSL not working Configuring the server authentication , ldap	3	1870	April 26, 2023
Facing issue for LDAPS connection from keycloak running on docker as non root user Getting advice	0	410	February 28, 2024
LDAP authentication failed Configuring the server ldap	0	764	April 23, 2021
Keycloak Connecting to MSAD LDAP Over SSL Configuring the server ldap	14	19724	February 24, 2022
LDAPS Test Authentication failing by using User Federation module in keycloak Getting advice authentication , ldap	0	476	November 25, 2022

Connect keycloak to LDAP over SSL

Related topics