RMM DokuWiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Setup openLDAP and integrate it with Keycloak ======

For that manual, we assume that you've already got a working Keycloak installation. Otherwise take a look at [[linux_server_manuals:docker_keycloak_container_with_local_postgresql]] first.
The manual was written for Debian Stretch, but should also work with other distributions.

===== openLDAP setup =====

Install openLDAP:

<code>
aptitude install slapd ldap-utils
</code>

We only want to accept localhost and docker connections, so:
edit /etc/default/slapd
<code>
SLAPD_SERVICES="ldap://127.0.0.1 ldap://172.17.0.1 ldapi:///"
</code>

restart ldap server
<code>
systemctl restart slapd
</code>

If you changed the above setting, that slapd should not listen on all hosts, then you also need to tell slapd it should not start up before docker. Otherwise the dockerinterface is not ready to bind to it:

<code>
systemctl edit slapd.service
</code>

In the editor that was opened enter:
<code>
[Unit]
After=docker.service
</code>

create file /tmp/test.ldif:
<code>
dn: ou=People,dc=example,dc=com
ou: People
objectClass: organizationalUnit

dn: ou=Group,dc=example,dc=com
ou: Group
objectClass: organizationalUnit
</code>

execute:
<code> 
ldapadd -x -D cn=admin,dc=example,dc=com -W -f /tmp/test.ldif 
</code>

create file member.ldif :
<code>
dn: cn=module,cn=config
cn: module
objectclass: olcModuleList
objectclass: top
olcmoduleload: memberof
olcmodulepath: /usr/lib/ldap

dn: olcOverlay={0}memberof,olcDatabase={1}mdb,cn=config
objectClass: olcConfig
objectClass: olcMemberOf
objectClass: olcOverlayConfig
objectClass: top
olcOverlay: memberof 
</code>

execute
<code>
ldapadd -Y EXTERNAL -Q -H ldapi:/// -f member.ldif
</code>

new file refint.ldif

<code>
dn: cn=module{1},cn=config
add: olcmoduleload
olcmoduleload: refint
</code>

execute
<code>
ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f refint.ldif
</code>

create file refintconf.ldif
<code>

dn: olcOverlay={1}refint,olcDatabase={1}mdb,cn=config
objectClass: olcConfig
objectClass: olcOverlayConfig
objectClass: olcRefintConfig
objectClass: top
olcOverlay: {1}refint
olcRefintAttribute: memberof member manager owner
</code>

execute
<code>
ldapadd -Q -Y EXTERNAL -H ldapi:/// -f refintconf.ldif
</code>

createfile index.ldif

<code>
dn: olcDatabase={1}mdb,cn=config
changetype: modify
add: olcDbIndex
olcDbIndex: memberOf, mail eq
</code>

execute:
<code>
ldapadd -Q -Y EXTERNAL -H ldapi:/// -f index.ldif
</code>

create file database.ldif to increase the maxsize of 1GB of the database.I once run out of space after only adding a few 100 users...
<file>
dn: olcDatabase={1}mdb,cn=config
changetype: modify
replace: OlcDbMaxSize
OlcDbMaxSize: 20073741824
</file>

Execute:
<code>
ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f database.ldif
</code>


===== Setup Keycloak LDAP federation =====

If you didn't create a new realm besides the master realm yet, do that now.

<WRAP center round tip 60%>
You should setup the LDAP integration before you add any users to Keycloak. Unfortunately Keycloak as of version 3.4.3 does not support to write already existing users to the LDAP directory. It only writes/adds them there on doing changes on the user.
</WRAP>

In the new realm click on "User Federation" and then on "Add Provider..."/"Ldap".

Set following settings:

^Setting ^ Value ^ Comment ^
|**import users** | on | only necessary if you also change users over other means than keycloak |
|**edit mode** | writeable |
|**sync registration** | on |
|**vendor** | other |
|**connection url** | ldap://172.17.0.1 | assuming keycloak is installed as docker image |
|**users dn** | ou=People,dc=example,dc=com |
|**bind dn** | cn=admin,dc=example,dc=com  |
|**bind credential** | <admin credentials which you've chosen on installind openLDAP> |

Then Save everything and click on Mappers.

Create a new mapper with following settings:
^ setting ^ value ^
|**name** | groups |
|**mapper type** | group-ldap-mapper |
|**ldap groups dn** | ou=Group,dc=example,dc=com |

Then edit the mapping: "first name" and change:
^ setting ^ value ^
|**ldap attribute** | givenName |

Create a new mapping
^ setting ^ value ^
|**name** | full name |
|**mapper type** | full-name-ldap-mapper |
|**LDAP Full Name Attribute** | cn |

Now newly created and changes to users should be synced to the ldap directory.