On pe, 23 elo 2019, Ronald Wimmer via FreeIPA-users wrote:
On 23.08.19 15:53, Jakub Hrozek via FreeIPA-users wrote:
>[...]
>Hmm, I don't remember from the top of my head which attributes does KC
>try to fetch, but e-mail sounds like what it would need, at least that's
>what's most commonly used for claims and such.
>
>If you correlate the KC lookup errors with ifp sssd logs, what is the
>exact lookup that KC is doing but that is failing?
The four attributes KC is trying to fetch are mail, givenName, sn and
telephoneNumber. The keycloak-sssd-configuration script adds somthing
like
ldap_user_extra_attrs = mail:mail, sn:mail, givenname:mail,
telephoneNumber:mail
to the domain section of sssd.conf. However, it looks like as if only
the mail attribute is retrieved from AD. Everything works fine with a
local IPA user.
Is this Keycloak installation done separate from IPA master? If
yes,
then you need to have ldap_user_extra_attrs on both IPA client where
Keycloak runs and on IPA masters that SSSD would talk to to obtain
information about AD users.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland