On 22.08.19 15:57, Jakub Hrozek via FreeIPA-users wrote:
[...]
As far as I remember, Keycloak uses the D-Bus interface of SSSD to
retrieve the user's attribute. Can you check if the ifp service is up
and running and if there are any helpful logs in the sssd_ifp.log file?

I do not get AD attributes apart from mail:

(Tue Aug 20 14:09:37 2019) [sssd[ifp]] [ifp_add_ldb_el_to_dict] (0x0400): element [mail] has value [Ronald.Wimmer@mydomain.at]
(Tue Aug 20 14:09:37 2019) [sssd[ifp]] [ifp_user_get_attr_handle_reply] (0x0080): Attribute givenname not present or has no values
(Tue Aug 20 14:09:37 2019) [sssd[ifp]] [ifp_user_get_attr_handle_reply] (0x0080): Attribute sn not present or has no values
(Tue Aug 20 14:09:37 2019) [sssd[ifp]] [ifp_user_get_attr_handle_reply] (0x0080): Attribute telephoneNumber not present or has no values

(Tue Aug 20 14:10:05 2019) [sssd[ifp]] [sbus_dispatch] (0x4000): dbus conn: 0x55a8f4758970 (Tue Aug 20 14:10:05 2019) [sssd[ifp]] [sbus_dispatch] (0x4000): Dispatching. (Tue Aug 20 14:10:05 2019) [sssd[ifp]] [sbus_signal_handler] (0x2000): Received D-Bus signal org.freedesktop.DBus.NameOwnerChanged (Tue Aug 20 14:10:05 2019) [sssd[ifp]] [sbus_signal_handler_got_caller_id] (0x0400): Got a signal from the bus.. (Tue Aug 20 14:10:05 2019) [sssd[ifp]] [sbus_signal_name_owner_changed] (0x0400): Clearing UIDs cache (Tue Aug 20 14:10:05 2019) [sssd[ifp]] [sbus_dispatch] (0x4000): dbus conn: 0x55a8f4758970 (Tue Aug 20 14:10:05 2019) [sssd[ifp]] [sbus_dispatch] (0x4000): Dispatching. (Tue Aug 20 14:10:05 2019) [sssd[ifp]] [sbus_signal_handler] (0x2000): Received D-Bus signal org.freedesktop.DBus.NameOwnerChanged (Tue Aug 20 14:10:05 2019) [sssd[ifp]] [sbus_signal_handler_got_caller_id] (0x0400): Got a signal from the bus.. (Tue Aug 20 14:10:05 2019) [sssd[ifp]] [sbus_signal_name_owner_changed] (0x0400): Clearing UIDs cache  

And here a keycloak log snippet:

Aug 20 13:10:46 keycloak-test.linux.mydomain.at standalone.sh[16537]: 13:10:46,967 WARN  [org.keycloak.services] (default task-52) KC-SERVICES0013: Failed authentication: org.keycloak
.federation.sssd.api.SSSDException: Failed to retrieve user's attributes. Check if SSSD service is active.
Aug 20 13:10:46 keycloak-test.linux.mydomain.at standalone.sh[16537]: at org.keycloak.federation.sssd.api.Sssd.getUser(Sssd.java:112)
Aug 20 13:10:46 keycloak-test.linux.mydomain.at standalone.sh[16537]: at org.keycloak.federation.sssd.SSSDFederationProvider.importUserToKeycloak(SSSDFederationProvider.java:114)
Aug 20 13:10:46 keycloak-test.linux.mydomain.at standalone.sh[16537]: at org.keycloak.federation.sssd.SSSDFederationProvider.findOrCreateAuthenticatedUser(SSSDFederationProvider.java:
109)