# Error when syncing keycloak with freeIPA

**URL:** <https://forum.keycloak.org/t/error-when-syncing-keycloak-with-freeipa/4183>\
**Category:** Miscellanaeous\
**Created:** [August 8, 2020, 3:49pm UTC](https://forum.keycloak.org/t/error-when-syncing-keycloak-with-freeipa/4183 "2020-08-08T15:49:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![SW1](https://avatars.discourse-cdn.com/v4/letter/s/ce7236/32.png) [@SW1](https://forum.keycloak.org/u/SW1)\
**Post date:** [August 8, 2020, 3:49pm UTC](https://forum.keycloak.org/t/error-when-syncing-keycloak-with-freeipa/4183/1 "2020-08-08T15:49:47Z")

</div>

Hi, I’m trying to set up keycloak to sync with freeIPA so I can manage user accounts using keycloak. I set up everything using this article here as an example (but enabled syncing):  
[https://blog.delouw.ch/2019/06/01/openid-and-saml-authentication-with-keycloak-and-freeipa/](https://blog.delouw.ch/2019/06/01/openid-and-saml-authentication-with-keycloak-and-freeipa/)  
Keycloak is v11.0 and freeIPA is v4.8.4.

When I try to add a user via keycloak, I get the message “Error! could not create the user”. Then when I check the keycloak logs, I see this:

LDAP: error code 65 - missing attribute “cn” required by object class “inetOrgPerson”  
]; remaining name ‘uid=newuser1,cn=users,cn=accounts,dc=ipa,dc=mytestdomain,dc=org’

Am I doing something wrong here? Any ideas would be appreciated.

Thanks,  
S

---

<div class="post-metadata">

**Author:** ![SW1](https://avatars.discourse-cdn.com/v4/letter/s/ce7236/32.png) [@SW1](https://forum.keycloak.org/u/SW1)\
**Post date:** [August 9, 2020, 8:19pm UTC](https://forum.keycloak.org/t/error-when-syncing-keycloak-with-freeipa/4183/2 "2020-08-09T20:19:10Z")

</div>

in case anyone is wondering, I managed to fix it. You have to add a mapper to user federation definitition and map the user’s full name to ‘cn’. Also, in order to create a user from keycloak into freeIPA, you have to set the UUID field to ‘uid’.

Either way, I found out the hard way that you MUST add users to Free IPA _FIRST_, then just sync to keycloak. There’s no way around it because keycloak can’t create the proper fields for the user to show up in FreeIPA.

---

<div class="post-metadata">

**Author:** ![Robinyo](https://avatars.discourse-cdn.com/v4/letter/r/dec6dc/32.png) [@Robinyo](https://forum.keycloak.org/u/Robinyo)\
**Post date:** [August 9, 2020, 8:58pm UTC](https://forum.keycloak.org/t/error-when-syncing-keycloak-with-freeipa/4183/3 "2020-08-09T20:58:14Z")

</div>

Things work as expected with OpenLDAP: [Keycloak, Flowable and OpenLDAP](https://robferguson.org/blog/2020/01/03/keycloak-flowable-and-openldap/)