On 23.08.19 18:03, Alexander Bokovoy wrote:
[...] Is this Keycloak installation done separate from IPA master? If
yes,
then you need to have ldap_user_extra_attrs on both IPA client where
Keycloak runs and on IPA masters that SSSD would talk to to obtain
information about AD users.
Keycloak runs on a separate machine (as an ipa client). What you are
saying is that all IPA masters would need to have sssd.conf tweaked
accordingly?
Cheers,
Ronald