SSSD seems to work now and I can login to Keycloak with an IPA user. Unfortunately, when trying to use an AD user I get an exception:

Aug 20 13:10:46[16537]: 13:10:46,967 WARN  [] (default task-52) KC-SERVICES0013: Failed authentication: org.keycloak

.federation.sssd.api.SSSDException: Failed to retrieve user's attributes. Check if SSSD service is active.

Aug 20 13:10:46[16537]: at org.keycloak.federation.sssd.api.Sssd.getUser(

Aug 20 13:10:46[16537]: at org.keycloak.federation.sssd.SSSDFederationProvider.importUserToKeycloak(

Aug 20 13:10:46[16537]: at org.keycloak.federation.sssd.SSSDFederationProvider.findOrCreateAuthenticatedUser(


SSSD service is active.