My environment CentOS 8, 2 Cores, 4 GB memory, 250 HDD Keycloak version 8.0.1 Java version 1.8.0_232 All, This is my first time using Keycloak and everything seemed to work well. I have enable/configured a User Federation LDAP with the vendor Active Directory and configured edit mode as WRITAB…

See: Keycloak, Flowable and OpenLDAP

I’m seeing the same on Keycloak 8.0.1 and Windows Server 2016 AD. Seems not to be a configuration issue, but rather a couple code issues: KEYCLOAK-12340 : the LDAP user password is not changed from the Keycloak Admin Console KEYCLOAK-12437 : AD-linked users can’t be enabled in Keycloak due to a ms…

Just curious (easy to overlook, but folks do it a lot with LDAP-enables applications), is your LDAP connection secure (LDAPS)? If not, AD won’t let you change your password over LDAP because it is insecure and can be sniffed, etc.

@teverson See: Keycloak, Flowable and OpenLDAP

I have upgrade Keycloak to version 9.0.2, The User “Enable” button stays on but does not enable the user on MSAD. When creating a user on Web UI I no longer can set the password for that user . Error! Could not modify attribute for DN. My bind user for User Federation was granted all permission…

Ah I now understand windows not changing Password Attribute, But I’m confused on configuring LDAPS. I have a pub and private key I used for Nginx (reverse proxy), My DC has a CA . So I tried this. https://bl.ocks.org/magnetikonline/0ccdabfec58eb1929c997d22e7341e45 , No Joy I’m very new at Certs e…

Hi @gsmith I had the same problem and solved it here using the Docker version of Keycloak. Maybe this helps, at least for the LDAPS connection. I still can’t change passwords… :roll_eyes:

Hi @gsmith , Not sure if you get this working but for my side it was that we were using ADLDS instead of ADDS so the proper account controls that we should use are: msad-lds-user-account-control-mapper. Hope this helps. [image]

Thank you, My issue ended up being I need LDAPS and learn how to create the certs for a secure connection between Keycloak and MSAD. Microsoft limit what is writable and the only way is using LDAPS This was my resolve using LDAPS from here. https://gist.github.com/magnetikonline/0ccdabf…

if ldap over ssl is already configured in AD server, in keycloak do i need to setup also?

User Federation Troubles

Getting advice

gsmith February 4, 2022, 5:19am 12

Sorry for the delay

Perhaps this post may help

Topic		Replies	Views
Keycloak problems creating new users after Update 8.0.1 Getting advice user-federation , ldap	5	2528	January 22, 2020
Realms LDAP-Federtation user password setting	0	249	November 16, 2023
Keycloak update password AD Configuring the server authentication	1	4291	July 9, 2021
Active Directory user password change: Keycloak accepts both old and new password Configuring the server	2	3123	November 9, 2020
Keycloak user federation mapper - MSAD user account control Getting advice user-federation	0	460	June 5, 2024

User Federation Troubles

Related topics