On 26.08.19 09:26, Jakub Hrozek via FreeIPA-users wrote:
Sorry, it's not totally clear to me if all the attributes were mapped to
mail by the KC installer or by your snippet?
The original config looked like it should after executing keycloak's
ldap_user_extra_attrs = mail:mail, sn:sn, givenname:givenname,
user_attributes = +mail, +telephoneNumber, +givenname, +sn
Does everything work if you remove the mappings?
Unfortunately not. Only "mail" is mapped for an AD user. The other three
attributes are not.