mirror of
https://github.com/lldap/lldap.git
synced 2026-04-25 08:15:52 +03:00
[GH-ISSUE #705] Keycloak : searching for users while LDAP User Federation is on doesn't work #251
Labels
No labels
backend
blocked
bug
cleanup
dependencies
docker
documentation
duplicate
enhancement
enhancement
frontend
github_actions
good first issue
help wanted
help wanted
integration
invalid
ldap
pull-request
question
rust
rust
tests
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/lldap-lldap#251
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @sbordeyne on GitHub (Oct 14, 2023).
Original GitHub issue: https://github.com/lldap/lldap/issues/705
Setup :
I followed the documentation here https://github.com/lldap/lldap/blob/main/example_configs/keycloak.md, and have the same group mappings, same settings. When searching for a user in keycloak, it crashes, and this is the traceback in the logs :
I've tried deleting the attribute mappers to only leave the
usernamemapper which maps to theuidattribute.Furthermore, is there an exhaustive list of LDAP attributes set by LLDAP ?
@nitnelave commented on GitHub (Oct 14, 2023):
Hi!
There's something weird with your filters (or is it intentional?): you're requesting for first names/last names and so on that start with the letter "s". You can see that in the error, the LDAP filter contains
(givenname=s*).LLDAP only supports substring search for UIDs.
The list of supported attributes is for now only uid, email, first/last/display name and jpegPhoto (plus memberOf for group membership).
But with issue #67, you'll be able to add any attribute you want, as well as see the schema (the frontend part is not implemented yet, but the backend is almost done)
@roseap42 commented on GitHub (Oct 15, 2023):
Ran into this same scenario this morning. My kludgy fix was to import ldap users into keycloak, disable ldap full/periodic sync, and then change the firstname/lastname mappings to use uid. (Certainly not a long-term solution, or anything that would work for more than a self-hosted small family sized set of users).
Adding attributes (as you mention in issue #67) will be awesome! However, the problem here is that we can't substring search on firstname/lastame (which I can verify using ldapsearch). Or am I misunderstanding and 67 will add or solve that?
Lastly, this is such a great project, thank you. I was trying to implement 389ds previously, which is neither simple nor "lightweight".
@sbordeyne commented on GitHub (Oct 15, 2023):
This is a bug then, in LLDAP. Keycloak expects to substring search in attributes for firstName, lastName and userName. As per your message, LLDAP supports substring search for
I just updated my attribute mappings to map keycloak's firstName to LLDAP's firstname (as per your message, the LLDAP documentation misses the exact names of supported attributes.
I found this in the code, which looks like the list of supported attributes in LLDAP
github.com/lldap/lldap@9e88bfe6b4/server/src/domain/ldap/user.rs (L104C1-L114C3)Using anything BUT
uidresults in the aforementionned error. It makes it pretty hard to sync LLDAP to keycloak. Maybe for Keycloak, a more heavy duty solution like openLDAP is preferrable.I tested by mapping firstName to :
@nitnelave commented on GitHub (Oct 15, 2023):
Ah, no, to be clear: the list of attributes that I listed are the ones that
are supported in LLDAP at all!
Substring search is only implemented for UIDs, and I'm not sure how easy it
would be to adapt it to the more general case (the other attributes are
encoded differently so I can't just write a pattern in SQL). I could add
support for email without too much trouble, but for the rest of the
attributes it's going to be hard.
But I'm not sure I understand: why does KeyCloak need to do a substring
search?
On Sun, 15 Oct 2023, 20:52 Simon Bordeyne, @.***> wrote:
@roseap42 commented on GitHub (Oct 15, 2023):
Got it. And totally understand the balancing act of keeping this light and simple vs more and more features. This is exposed in keycloak in their user search function... keycloak imports users from ldap, so I imagine they're hitting their own list of users and ldap to help someone find a user whether they were imported or not? And to @sbordeyne 's point, keycloak may need a more fully featured ldap provider behind it. Thanks again.
@sbordeyne commented on GitHub (Oct 15, 2023):
Without any other configuration, Keycloak on its own tries to search by last name, first name and username. When you set up federated identities, that means doing fuzzy searches in the federated backends.
I feel like LLDAP is so close to being the perfect backend for Keycloak, but just that makes it a bit of a dealbreaker (not being able to add users to groups because the search breaks is kind of a dealbreaker, though mapping everything to uid is a working workaround if you don't mind your users being named
$uid $uid😄@nitnelave commented on GitHub (Oct 15, 2023):
Wouldn't it be possible to configure KeyCloak to only search by uid? That
seems like it'd give the most bang for the buck, especially with LLDAP
On Sun, 15 Oct 2023, 22:57 Simon Bordeyne, @.***> wrote:
@sbordeyne commented on GitHub (Oct 16, 2023):
Unfortunately, I haven't found a way to customize the default search in Keycloak. I feel like I'll move over to OpenLDAP since I'll want to handle everything in Keycloak anyways (password resets, identity management, user federation...). Thanks for your time.
@nitnelave commented on GitHub (Oct 16, 2023):
Alright, sorry it couldn't work for you. Make sure to check out kanidm too as a fully-featured LDAP server (AFAIK) that's much more modern and lighter than OpenLDAP (and might even replace KeyCloak for your use case?) The dev is a friend and very knowledgeable in all things LDAP.
@sbordeyne commented on GitHub (Oct 16, 2023):
Thanks for the recommendation, though I'll stick with keycloak for other reasons, namely that it's used in enterprise grade software as well for identity management, and I want to become more proficient at it to be able to add strings to my bow so to speak.
Furthermore, I've already set up Keycloak (with great trouble), so I don't feel like uprooting my whole IDP again right now
@nbently commented on GitHub (Jan 12, 2024):
Figured out a workaround in case anyone is interested. I wasn't able to find a way to modify Keycloak's default LDAP search filter, however if you search for the uid in quotes, (e.g. "jdoe") in Keycloak's user search box, it seems to work. I suspect enclosing a value in quotes forces it to search only on uid.