On 23.08.19 15:53, Jakub Hrozek via FreeIPA-users wrote:
Hmm, I don't remember from the top of my head which attributes does KC
try to fetch, but e-mail sounds like what it would need, at least that's
what's most commonly used for claims and such.
If you correlate the KC lookup errors with ifp sssd logs, what is the
exact lookup that KC is doing but that is failing?
The four attributes KC is trying to fetch are mail, givenName, sn and
telephoneNumber. The keycloak-sssd-configuration script adds somthing like
ldap_user_extra_attrs = mail:mail, sn:mail, givenname:mail,
to the domain section of sssd.conf. However, it looks like as if only
the mail attribute is retrieved from AD. Everything works fine with a
local IPA user.