# How to configure keyCloak to understand a two-way user-group binding

**URL:** <https://forum.keycloak.org/t/how-to-configure-keycloak-to-understand-a-two-way-user-group-binding/9401>\
**Category:** Configuring the server\
**Tags:** admin-console, user-federation\
**Created:** [June 2, 2021, 5:01pm UTC](https://forum.keycloak.org/t/how-to-configure-keycloak-to-understand-a-two-way-user-group-binding/9401 "2021-06-02T17:01:04Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![scottyJamison](https://avatars.discourse-cdn.com/v4/letter/s/ea5d25/32.png) [@scottyJamison](https://forum.keycloak.org/u/scottyJamison)\
**Post date:** [June 2, 2021, 5:01pm UTC](https://forum.keycloak.org/t/how-to-configure-keycloak-to-understand-a-two-way-user-group-binding/9401/1 "2021-06-02T17:01:05Z")

</div>

We’re looking at switching our product to use keyCloak for authentication and user-management. We have already been using LDAP, and have a wonky setup where we have been storing the user-group relationship on both the user objects and the group objects in LDAP.

For example, a group with user’s “person1” and “person2” would have these attributes (yes, the same group is stored in two different attributes):

```auto
member: uid=person1,ou=People,dc=example,dc=com
member: uid=person2,ou=People,dc=example,dc=com
memberUid: person1
memberUid: person2

```

And a user with groups “group1” and “group2” would have these attributes:

```auto
memberOf: cn=group1,ou=Groups,dc=example,dc=com
memberOf: cn=group2,ou=Groups,dc=example,dc=com

```

Is it possible to configure keyCloak to support this kind of setup? I’ve been able to figure out how create a custom group-ldap-mapper to import groups based on one of these attributes, but I couldn’t find any configuration to have it support reading and updating from all three.

If this isn’t possible to do, that’s fine. We’re wanting to eventually refactor some things to allow us to take out this two-way user-group binding system we have, but it would be nice if this refactoring didn’t have to be done _right_ now.

---

<div class="post-metadata">

**Author:** ![lombao](https://avatars.discourse-cdn.com/v4/letter/l/c68b51/32.png) [@lombao](https://forum.keycloak.org/u/lombao)\
**Post date:** [June 3, 2021, 6:44pm UTC](https://forum.keycloak.org/t/how-to-configure-keycloak-to-understand-a-two-way-user-group-binding/9401/2 "2021-06-03T18:44:07Z")

</div>

I think the problem is the first part. The ldap group mapper has an specific attribute to define the membership attribute: " Membership LDAP Attribute “, and, as far as I see is a unique value, so you have to choose either  
Membership LDAP Attribute ===\> with “member”  
Membership Attribute Type” ===\> with value DN

OR

Membership LDAP Attribute ===\> with “memberUid”  
Membership Attribute Type" ===\> with value UID

But , AFAIK you have to choose one combination. the field " Membership LDAP Attribute" seems to be a single value field.

---

<div class="post-metadata">

**Author:** ![scottyJamison](https://avatars.discourse-cdn.com/v4/letter/s/ea5d25/32.png) [@scottyJamison](https://forum.keycloak.org/u/scottyJamison)\
**Post date:** [June 3, 2021, 7:10pm UTC](https://forum.keycloak.org/t/how-to-configure-keycloak-to-understand-a-two-way-user-group-binding/9401/3 "2021-06-03T19:10:02Z")

</div>

So, you’re saying keyCloak should support a two-way user/group binding just fine? The main issue I’ll be running into is the fact that our groups hold membership information in two different places on the group object?

OK, thanks for the information. Maybe we can see about just that part up for now, and see what happens.

---

<div class="post-metadata">

**Author:** ![lombao](https://avatars.discourse-cdn.com/v4/letter/l/c68b51/32.png) [@lombao](https://forum.keycloak.org/u/lombao)\
**Post date:** [June 3, 2021, 7:17pm UTC](https://forum.keycloak.org/t/how-to-configure-keycloak-to-understand-a-two-way-user-group-binding/9401/4 "2021-06-03T19:17:27Z")

</div>

> Blockquote The main issue I’ll be running into is the fact that our groups hold membership information in two different places on the group object?

Yep, your groups have two “MEMBER” attributes. To the best of my knowledge this is something Keycloak cannot manage. You have to choose one … probably the one which is linked to the memberOf.

---

<div class="post-metadata">

**Author:** ![scottyJamison](https://avatars.discourse-cdn.com/v4/letter/s/ea5d25/32.png) [@scottyJamison](https://forum.keycloak.org/u/scottyJamison)\
**Post date:** [June 3, 2021, 7:57pm UTC](https://forum.keycloak.org/t/how-to-configure-keycloak-to-understand-a-two-way-user-group-binding/9401/5 "2021-06-03T19:57:33Z")

</div>

Alright, thanks for the help!