# \#user-federation **URL:** https://forum.keycloak.org/tag/user-federation/71.md [Latest](https://forum.keycloak.org/latest.md) · [Categories](https://forum.keycloak.org/categories.md) · [Tags](https://forum.keycloak.org/tags.md) --- ## [Configuring/federating user and groups from AD Ldap](https://forum.keycloak.org/t/configuring-federating-user-and-groups-from-ad-ldap/31655)
**Author:** [@tochin](https://forum.keycloak.org/u/tochin)\ **Replies:** 0\ **Last updated:** [August 18, 2026, 3:17pm UTC](https://forum.keycloak.org/t/configuring-federating-user-and-groups-from-ad-ldap/31655 "2026-08-18T15:17:48Z")
We are attempting to federate users and groups from AD LDAP into Keycloak. We do not want to maintain a live connection to LDAP so we are using a Sync Mode of Import. We ideally would like the entire LDAP tree to be st… --- ## [Groupmembership are not visible anymore at Keycloak UI after upgrade from version 26.6.4 to 26.7.0](https://forum.keycloak.org/t/groupmembership-are-not-visible-anymore-at-keycloak-ui-after-upgrade-from-version-26-6-4-to-26-7-0/31642)
**Author:** [@norbert.pourie](https://forum.keycloak.org/u/norbert.pourie)\ **Replies:** 2\ **Last updated:** [August 6, 2026, 10:17am UTC](https://forum.keycloak.org/t/groupmembership-are-not-visible-anymore-at-keycloak-ui-after-upgrade-from-version-26-6-4-to-26-7-0/31642 "2026-08-06T10:17:17Z")
We upgraded from Keycloak version 26.6.4 to 26.7.0 and recognized that now the groupmembership imported from AD via LDAP-Föderation is not showing up anymore at Keycloak UI at the groups membership tab. The membership at… --- ## [{“errorMessage”:”Bad Request”} when using admin api](https://forum.keycloak.org/t/errormessage-bad-request-when-using-admin-api/31599)
**Author:** [@Bily-SX](https://forum.keycloak.org/u/Bily-SX)\ **Replies:** 0\ **Last updated:** [July 16, 2026, 2:46am UTC](https://forum.keycloak.org/t/errormessage-bad-request-when-using-admin-api/31599 "2026-07-16T02:46:34Z")
I am trying to use the admin api to update user info but when the api is called it returns this error: {StatusCode: 400, ReasonPhrase: 'Bad Request'} PUT /admin/realms/{realm}/users/{user-id} The weird part is that wh… --- ## [Migration users from 18 to 26](https://forum.keycloak.org/t/migration-users-from-18-to-26/31277)
**Author:** [@akhrulloi](https://forum.keycloak.org/u/akhrulloi)\ **Replies:** 2\ **Last updated:** [February 18, 2026, 6:23am UTC](https://forum.keycloak.org/t/migration-users-from-18-to-26/31277 "2026-02-18T06:23:07Z")
My current issue: I have a running Keycloak 18 instance that is actively used in production. On another server, I have deployed Keycloak 26 and configured it to match the Keycloak 18 setup as closely as possible. The n… --- ## [Keycloak realm import strategy – OVERWRITE\_EXISTING vs IGNORE\_EXISTING](https://forum.keycloak.org/t/keycloak-realm-import-strategy-overwrite-existing-vs-ignore-existing/31234)
**Author:** [@djordje](https://forum.keycloak.org/u/djordje)\ **Replies:** 3\ **Last updated:** [January 6, 2026, 5:45pm UTC](https://forum.keycloak.org/t/keycloak-realm-import-strategy-overwrite-existing-vs-ignore-existing/31234 "2026-01-06T17:45:02Z")
Hi all, I’ve been using Keycloak for several years, and up until now I’ve always relied on the OVERWRITE\_EXISTING realm import strategy. The main reason was consistency across environments — every deploy results in an… --- ## [Missing FEDERATED\_ID\_TOKEN from Federated Identity using microsoft provider](https://forum.keycloak.org/t/missing-federated-id-token-from-federated-identity-using-microsoft-provider/31190)
**Author:** [@KasperDamgaard](https://forum.keycloak.org/u/KasperDamgaard)\ **Replies:** 3\ **Last updated:** [December 5, 2025, 11:21am UTC](https://forum.keycloak.org/t/missing-federated-id-token-from-federated-identity-using-microsoft-provider/31190 "2025-12-05T11:21:09Z")
Hey, I am trying to get the FEDERATED\_ID\_TOKEN from the userSessionModel as such: String tokenString = userSession.getNote("FEDERATED\_ID\_TOKEN"); However, it does not seem to be present when I use the microsoft IDP. I… --- ## [Federated user not removed when deleted or recreated at source](https://forum.keycloak.org/t/federated-user-not-removed-when-deleted-or-recreated-at-source/31136)
**Author:** [@mildis](https://forum.keycloak.org/u/mildis)\ **Replies:** 0\ **Last updated:** [October 8, 2025, 1:03pm UTC](https://forum.keycloak.org/t/federated-user-not-removed-when-deleted-or-recreated-at-source/31136 "2025-10-08T13:03:16Z")
Hi, We developed our own user federation provider to pull users from a legacy application. It works fine : users and their attributes are retrieved. We do not import user in the keycloak database. We are also relying … --- ## [Created LDAP Federation Component Programmatically But Not Visible in Realm's UI](https://forum.keycloak.org/t/created-ldap-federation-component-programmatically-but-not-visible-in-realms-ui/31102)
**Author:** [@littleratinjail](https://forum.keycloak.org/u/littleratinjail)\ **Replies:** 0\ **Last updated:** [September 17, 2025, 9:45am UTC](https://forum.keycloak.org/t/created-ldap-federation-component-programmatically-but-not-visible-in-realms-ui/31102 "2025-09-17T09:45:02Z")
Hello, I’m trying to create LDAP user federation connection programmatically but I’m having issues with having it display in Keycloak UI. Situation: I create the component correctly because I receive a success (HTTP 2… --- ## [How to get pagination with a custom storage provider?](https://forum.keycloak.org/t/how-to-get-pagination-with-a-custom-storage-provider/31092)
**Author:** [@lbelloq](https://forum.keycloak.org/u/lbelloq)\ **Replies:** 2\ **Last updated:** [September 8, 2025, 12:52pm UTC](https://forum.keycloak.org/t/how-to-get-pagination-with-a-custom-storage-provider/31092 "2025-09-08T12:52:18Z")
Hi, I’m learning how to implement a custom storage provider for Keycloak (straight from a database) and so far Keycloak can activate and use my provider, but when listing users, it only shows users in the first page and … --- ## [“Invalid token” during external token-exchange (Keycloak ↔ Auth0) — client credentials and password grants both failing](https://forum.keycloak.org/t/invalid-token-during-external-token-exchange-keycloak-auth0-client-credentials-and-password-grants-both-failing/30195)
**Author:** [@Sarthakjain](https://forum.keycloak.org/u/Sarthakjain)\ **Replies:** 0\ **Last updated:** [July 4, 2025, 8:59am UTC](https://forum.keycloak.org/t/invalid-token-during-external-token-exchange-keycloak-auth0-client-credentials-and-password-grants-both-failing/30195 "2025-07-04T08:59:35Z")
I’m stuck on an “Invalid token” error when brokering Auth0 tokens through Keycloak. The issue shows up for both the client credentials and the password (ROPC / Direct-Access) grants, and I can’t see what I’m missing. Any… --- ## [How to Disable the Credentials Tab for All User Roles in Keycloak](https://forum.keycloak.org/t/how-to-disable-the-credentials-tab-for-all-user-roles-in-keycloak/30135)
**Author:** [@Dipak](https://forum.keycloak.org/u/Dipak)\ **Replies:** 0\ **Last updated:** [June 23, 2025, 11:10am UTC](https://forum.keycloak.org/t/how-to-disable-the-credentials-tab-for-all-user-roles-in-keycloak/30135 "2025-06-23T11:10:23Z")
Requirement Statement: I want to disable the “Credentials” tab in Keycloak for all users, including administrators, so that no one can set or reset user passwords directly from the Admin Console. Currently, the Admin Co… --- ## [How to revoke a user's session in SPI when group is updated via LDAP sync?](https://forum.keycloak.org/t/how-to-revoke-a-users-session-in-spi-when-group-is-updated-via-ldap-sync/30103)
**Author:** [@SKDragon18](https://forum.keycloak.org/u/SKDragon18)\ **Replies:** 1\ **Last updated:** [June 19, 2025, 12:22pm UTC](https://forum.keycloak.org/t/how-to-revoke-a-users-session-in-spi-when-group-is-updated-via-ldap-sync/30103 "2025-06-19T12:22:36Z")
Hi all, I’m developing a custom Keycloak EventListener SPI to handle the case when a user’s group membership changes, typically due to an LDAP sync (group mapping from LDAP to Keycloak). My goal is: When a user is ad… --- ## [In Organization, a user does not automatically register to organization after first login](https://forum.keycloak.org/t/in-organization-a-user-does-not-automatically-register-to-organization-after-first-login/29406)
**Author:** [@aalto](https://forum.keycloak.org/u/aalto)\ **Replies:** 3\ **Last updated:** [May 15, 2025, 6:18am UTC](https://forum.keycloak.org/t/in-organization-a-user-does-not-automatically-register-to-organization-after-first-login/29406 "2025-05-15T06:18:36Z")
Hey all! I’m exploring KC as our next idP for a product I work on and would like to eventually use the organizations feature for multitenancy. I’m confused about how a user should be registered to an organization with a… --- ## [Active Directory user / group sync broken](https://forum.keycloak.org/t/active-directory-user-group-sync-broken/29830)
**Author:** [@Uproot2835](https://forum.keycloak.org/u/Uproot2835)\ **Replies:** 0\ **Last updated:** [March 31, 2025, 10:01am UTC](https://forum.keycloak.org/t/active-directory-user-group-sync-broken/29830 "2025-03-31T10:01:16Z")
Hello, I have a Keycloak (26.1.2) server with a user-federation from an Active-Directory. The sync is broken, no new user or group are synced. However the sync process say it is ok “Sync of users finished successfully.… --- ## [Disable/Enable of LDAP users (only in keycloak) not working](https://forum.keycloak.org/t/disable-enable-of-ldap-users-only-in-keycloak-not-working/29798)
**Author:** [@akhildaskailas](https://forum.keycloak.org/u/akhildaskailas)\ **Replies:** 0\ **Last updated:** [March 24, 2025, 9:30am UTC](https://forum.keycloak.org/t/disable-enable-of-ldap-users-only-in-keycloak-not-working/29798 "2025-03-24T09:30:30Z")
I have imported users from LDAP with UNSYNCHED mode. I wanted to disable or enable users only in keycloak. But its not working , is there anything i need to consider here. --- ## [Invalid\_user\_credentials error with Microsoft Active Directory as IdP](https://forum.keycloak.org/t/invalid-user-credentials-error-with-microsoft-active-directory-as-idp/24024)
**Author:** [@gah1289](https://forum.keycloak.org/u/gah1289)\ **Replies:** 1\ **Last updated:** [March 11, 2025, 11:12pm UTC](https://forum.keycloak.org/t/invalid-user-credentials-error-with-microsoft-active-directory-as-idp/24024 "2025-03-11T23:12:08Z")
I have an issue where customers are using Microsoft Active Directory + Okta and receiving an invalid username/password error in Keycloak after providing the correct password. Flow: User successfully logs into Microsoft … --- ## [TLS Hostname verification not working properly](https://forum.keycloak.org/t/tls-hostname-verification-not-working-properly/29416)
**Author:** [@Tester123](https://forum.keycloak.org/u/Tester123)\ **Replies:** 2\ **Last updated:** [January 23, 2025, 10:15pm UTC](https://forum.keycloak.org/t/tls-hostname-verification-not-working-properly/29416 "2025-01-23T22:15:55Z")
Hello, I am configuring an LDAP connection for user federation but our DNS servers aren’t resolving the domain controller hostname so I thought I would just use the IPs in the connection URL. I activated --tls-hostname-v… --- ## [Social Login not working as expected with User Storage SPI](https://forum.keycloak.org/t/social-login-not-working-as-expected-with-user-storage-spi/29333)
**Author:** [@thebrijpatel](https://forum.keycloak.org/u/thebrijpatel)\ **Replies:** 3\ **Last updated:** [January 6, 2025, 8:55am UTC](https://forum.keycloak.org/t/social-login-not-working-as-expected-with-user-storage-spi/29333 "2025-01-06T08:55:37Z")
Hi everyone, I am working on creating a User Storage SPI for my Keycloak setup with the aim of migrating users from my external users table (created using legacy auth) into Keycloak. Here’s the flow I am aiming for: A… --- ## [Keycloak custom login provider](https://forum.keycloak.org/t/keycloak-custom-login-provider/29212)
**Author:** [@anvaribrohim](https://forum.keycloak.org/u/anvaribrohim)\ **Replies:** 2\ **Last updated:** [December 25, 2024, 7:28am UTC](https://forum.keycloak.org/t/keycloak-custom-login-provider/29212 "2024-12-25T07:28:57Z")
Hi everyone, I wanna customize our keycloak and what I have to do as you can see first we check his keys and if it is correct and not expired then we let him to enter and also everytime user enters we need to save his… --- ## [UserStorageProvider SPI Implementation and Caching](https://forum.keycloak.org/t/userstorageprovider-spi-implementation-and-caching/29216)
**Author:** [@pauloj](https://forum.keycloak.org/u/pauloj)\ **Replies:** 3\ **Last updated:** [December 18, 2024, 8:34pm UTC](https://forum.keycloak.org/t/userstorageprovider-spi-implementation-and-caching/29216 "2024-12-18T20:34:06Z")
I have been working on a UserStorageProvider SPI implementation connected to an external store/db. Have most things working as I would expect however I am a bit confused on the general flow of calls and the idea of the u… --- ## [Creating client scope with read only user meta data](https://forum.keycloak.org/t/creating-client-scope-with-read-only-user-meta-data/29253)
**Author:** [@akhildaskailas](https://forum.keycloak.org/u/akhildaskailas)\ **Replies:** 0\ **Last updated:** [December 17, 2024, 11:58am UTC](https://forum.keycloak.org/t/creating-client-scope-with-read-only-user-meta-data/29253 "2024-12-17T11:58:50Z")
I have set up LDAP integration and need to include LDAP group information in the JWT token. I found that mapping LDAP groups to Keycloak groups is a possible solution, but it’s not feasible for me since I already have ex… --- ## [Role mapping for grafana](https://forum.keycloak.org/t/role-mapping-for-grafana/29034)
**Author:** [@daddydayz](https://forum.keycloak.org/u/daddydayz)\ **Replies:** 0\ **Last updated:** [December 2, 2024, 4:59pm UTC](https://forum.keycloak.org/t/role-mapping-for-grafana/29034 "2024-12-02T16:59:51Z")
I am using keycloak 25.0.2, i am having issues role mapping on keycloak. i currently have a role created in “User federation - Ldap - Mappers - Grafana\_Admin” here are its settings LDAP Roles DN: CN=Grafana Admins,OU=Ap… --- ## [X509 Validate Username](https://forum.keycloak.org/t/x509-validate-username/29029)
**Author:** [@drewnicolette](https://forum.keycloak.org/u/drewnicolette)\ **Replies:** 0\ **Last updated:** [December 2, 2024, 2:18pm UTC](https://forum.keycloak.org/t/x509-validate-username/29029 "2024-12-02T14:18:45Z")
Hello, I am using the X509 Validate Username flow. My configuration is below - In the logs I see that the certificate is being populated in the username field of the request and being validated there. Is this the de… --- ## [Best Approach for Integrating Keycloak with ERP System for IAM and SSO in Microservices Architecture](https://forum.keycloak.org/t/best-approach-for-integrating-keycloak-with-erp-system-for-iam-and-sso-in-microservices-architecture/28977)
**Author:** [@abhinav.parmar](https://forum.keycloak.org/u/abhinav.parmar)\ **Replies:** 2\ **Last updated:** [November 29, 2024, 7:27am UTC](https://forum.keycloak.org/t/best-approach-for-integrating-keycloak-with-erp-system-for-iam-and-sso-in-microservices-architecture/28977 "2024-11-29T07:27:10Z")
We are in the process of architecting an ERP system for a small enterprise. Our technology stack is relatively simple, with backend modules developed using Spring Boot (e.g., HRMS, CRM, Logistics, QC, etc.) and the front… --- ## [How to add separate ldap query to retrieve the email address?](https://forum.keycloak.org/t/how-to-add-separate-ldap-query-to-retrieve-the-email-address/28728)
**Author:** [@asdfasdf](https://forum.keycloak.org/u/asdfasdf)\ **Replies:** 2\ **Last updated:** [November 22, 2024, 7:31pm UTC](https://forum.keycloak.org/t/how-to-add-separate-ldap-query-to-retrieve-the-email-address/28728 "2024-11-22T19:31:25Z")
I wondered how I could retrieve the email address from ldap which is not stored in the same entry. --- ## [Update users on keycloak returns 403 without realm-management roles](https://forum.keycloak.org/t/update-users-on-keycloak-returns-403-without-realm-management-roles/11045)
**Author:** [@adit-negi](https://forum.keycloak.org/u/adit-negi)\ **Replies:** 1\ **Last updated:** [November 12, 2024, 11:57am UTC](https://forum.keycloak.org/t/update-users-on-keycloak-returns-403-without-realm-management-roles/11045 "2024-11-12T11:57:12Z")
The keycloak REST API for updating users returns 403. I generated a token for user X using client credentials. Now for user X I would like to update some property. Intuitively a user should be allowed to update themselve… --- ## [LDAP+Kerberos User Federation using GSSAPI/SASL for LDAP authentication](https://forum.keycloak.org/t/ldap-kerberos-user-federation-using-gssapi-sasl-for-ldap-authentication/26114)
**Author:** [@j1mbl3s](https://forum.keycloak.org/u/j1mbl3s)\ **Replies:** 3\ **Last updated:** [October 28, 2024, 11:44am UTC](https://forum.keycloak.org/t/ldap-kerberos-user-federation-using-gssapi-sasl-for-ldap-authentication/26114 "2024-10-28T11:44:35Z")
Apologies if this has been discussed before but I could not find a similar thread on this specific topic. I am new to using Keycloak and hoping I don’t have to change my security model for this. I have an authenticatio… --- ## [Failed to login via IdP broker - federated identity already exists, unique constraint "constraint\_40" is violated](https://forum.keycloak.org/t/failed-to-login-via-idp-broker-federated-identity-already-exists-unique-constraint-constraint-40-is-violated/28330)
**Author:** [@pista](https://forum.keycloak.org/u/pista)\ **Replies:** 0\ **Last updated:** [October 15, 2024, 10:10am UTC](https://forum.keycloak.org/t/failed-to-login-via-idp-broker-federated-identity-already-exists-unique-constraint-constraint-40-is-violated/28330 "2024-10-15T10:10:51Z")
Hello all, i encountered following issue, while authenticating with our custom IdP inside our company. There are 3 possible ways to login into our IdP: user credentials, windows/kerberos login and login via card with ce… --- ## [Integrating Key Cloak](https://forum.keycloak.org/t/integrating-key-cloak/28092)
**Author:** [@Godavari](https://forum.keycloak.org/u/Godavari)\ **Replies:** 0\ **Last updated:** [September 28, 2024, 12:33pm UTC](https://forum.keycloak.org/t/integrating-key-cloak/28092 "2024-09-28T12:33:19Z")
Hello All, I need some suggestions/help, We want to integrate keycloak in our application to stores thousands of customers username and password, and fetch token while authentication process.( We did this activity usin… --- ## [User can't login, event log shows "email\_in\_use"](https://forum.keycloak.org/t/user-cant-login-event-log-shows-email-in-use/28055)
**Author:** [@croaklumpish](https://forum.keycloak.org/u/croaklumpish)\ **Replies:** 0\ **Last updated:** [September 25, 2024, 6:46pm UTC](https://forum.keycloak.org/t/user-cant-login-event-log-shows-email-in-use/28055 "2024-09-25T18:46:02Z")
We have a user that can’t login to an OpenID app we have via Keycloak. The user federation is through/imported from LDAP. The event log shows “No user details” with “email\_in\_use”. Their account was initially marked “di… [Next page](https://forum.keycloak.org/tag/user-federation/71.md?match_all_tags=true&page=1&tags%5B%5D=user-federation)