On Fri, Aug 23, 2019 at 05:48:18PM +0200, Ronald Wimmer via FreeIPA-users wrote:
On 23.08.19 15:53, Jakub Hrozek via FreeIPA-users wrote:
> Hmm, I don't remember from the top of my head which attributes does KC
> try to fetch, but e-mail sounds like what it would need, at least that's
> what's most commonly used for claims and such.
> If you correlate the KC lookup errors with ifp sssd logs, what is the
> exact lookup that KC is doing but that is failing?
The four attributes KC is trying to fetch are mail, givenName, sn and
telephoneNumber. The keycloak-sssd-configuration script adds somthing like
ldap_user_extra_attrs = mail:mail, sn:mail, givenname:mail,
Wait, do they really map all these attributes to mail? This seems wrong,
the format is externalname:ldapname and IIRC the last one wins, so the last
one is applied and stores mail as telephoneNumber.
So given the LDAP server is IPA, could you change the config to fetch
the proper LDAP attributes? Actually all the attribute names they use
for the cachename are the same in LDAP, so you could just use:
ldap_user_extra_attrs = mail, sn, givenname, telephonenumber
(Unless they also reversed the order of attrs..)