Sync about 1000 users from AD with nested groups

1

Hi All,

  1. Keycloak will not show AD nested groups as “child groups” under the parent in the Groups page. AD represents nesting by putting a group’s DN inside another group’s member attribute; it is not an OU/tree hierarchy. Keycloak’s “child groups” view only reflects hierarchical group containers (e.g., OU → CN trees), not AD’s member-of nesting.

  2. AD provides a special matching rule that expands nested memberOf references: 1.2.840.113556.1.4.1941 (also called LDAP_MATCHING_RULE_IN_CHAIN), which can be added to the LDAP filter.

  3. Confirmed the new LDAP filter works using ldapsearch, and imported well over 1000 users, however, it also did not work consistently due to timeout issues on the AD side it appears.

  4. It managed to import once or twice in keycloak, but sync performance is poor, and does not always work.

Please help us on how to get this working smoothly with optimal performance

thanks in advance!

2

Hey,

  1. Check your LDAP Config and group-to-group mapper Config. There should be a radio button for “preserve inheritance” or “preserve hierarchy”

  2. probably your LDAP is then the bottleneck

  3. I got this also for a customer. LDAP is slow as they are syncing 20k groups. Group Membership is calculated on the fly.

Dump question, can you bump up the resources of your LDAP?