# Keycloak SSSD Federation with Idm users not show up on admin console

**URL:** <https://forum.keycloak.org/t/keycloak-sssd-federation-with-idm-users-not-show-up-on-admin-console/29262>\
**Category:** Configuring the server\
**Created:** [December 17, 2024, 7:49pm UTC](https://forum.keycloak.org/t/keycloak-sssd-federation-with-idm-users-not-show-up-on-admin-console/29262 "2024-12-17T19:49:29Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![mamlouka](https://avatars.discourse-cdn.com/v4/letter/m/5daacb/32.png) [@mamlouka](https://forum.keycloak.org/u/mamlouka)\
**Post date:** [December 17, 2024, 7:49pm UTC](https://forum.keycloak.org/t/keycloak-sssd-federation-with-idm-users-not-show-up-on-admin-console/29262/1 "2024-12-17T19:49:29Z")

</div>

Hi, I am currently trying to configure my Keycloak Server (26.0.5) to be Federated via SSSD with my FreeIPA server. I have created a Keycloak Realm, that has the SSSD Federation created.  
And the SSSD option show up in the user federation menu in the admin console. All it’s ok but I can’t see the users on admin console.  
SSSD  
Enrolled my server to the domain and ran federation-sssd-setup.sh on the host to configure /etc/sssd/sssd.conf:

```auto
[domain/ **********]

id_provider = ipa
dns_discovery_domain = ************
ipa_server = **************
ipa_domain = ***********
ipa_hostname = keycloak
auth_provider = ipa
chpass_provider = ipa
access_provider = ipa
cache_credentials = True
ldap_tls_cacert = /etc/ipa/ca.crt
ldap_user_extra_attrs = mail:mail, sn:sn, givenname:givenname, telephoneNumber:telephoneNumber
krb5_store_password_if_offline = True
[sssd]
services = nss, pam, ssh, sudo, ifp

domains = ********
[nss]
homedir_substring = /home
[ifp]
allowed_uids = root, keycloak
user_attributes = +mail, +telephoneNumber, +givenname, +sn

```

And /etc/pam.d/keycloak:

```auto
  auth required pam_sss.so
  account required pam_sss.so

```

everything is working as expected by running dbus-send , i can see GetUserAttr and GetUserGroups also sssctl work fine

`sssctl user-checks username -s keycloak`

keycloak basic config just to test

```auto
/opt/keycloak/keycloak-26.0.5/bin/kc.sh show-config
Current Mode: production
Current Configuration:
	kc.config.args = show-config (SysPropConfigSource)
	kc.config.built = true (SysPropConfigSource)
	kc.db = dev-file (Persisted)
	kc.health-enabled = true (keycloak.conf)
	kc.hostname-strict = false (keycloak.conf)
	kc.http-enabled = true (keycloak.conf)
	kc.http-port = 8080 (keycloak.conf)
	kc.http-relative-path = / (keycloak.conf)
	kc.https-port = 8443 (keycloak.conf)
	kc.log = file (keycloak.conf)
	kc.log-file = /opt/keycloak/keycloak-26.0.5/data/log/keycloak.log (keycloak.conf)
	kc.log-file-format = %d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c] (%t) %s%e%n (keycloak.conf)
	kc.log-level = info (keycloak.conf)
	kc.metrics-enabled = false (keycloak.conf)
	kc.optimized = true (Persisted)
	kc.proxy-headers = xforwarded (keycloak.conf)
	kc.spi-hostname-v2-hostname-strict = false (keycloak.conf)
	kc.spi-sticky-session-encoder-infinispan-should-attach-route = false (keycloak.conf)
	kc.transaction-xa-enabled = true (keycloak.conf)
	kc.version = 26.0.5 (SysPropConfigSource)

```