How to set UUID of user from User Federation (LDAP)? #50838
|
Is it possible to set the User ID (which populates the sub claim field) of a user from the federated user storage provider? Currently, it appears Keycloak insists on generating a random UUID for each user synced from LDAP. Using the "UUID LDAP attribute" field would be my expectation, but that appears to only be used for syncing, not providing Keycloak user ID / sub. |
Replies: 2 comments
|
I've attempted to create a |
|
Looks like if you configure LDAP User Storage Provider with "Import users"=OFF, then you get User IDs of the form: In my use case Keycloak upgrades are built from scratch and configuration is simply scripted with admin CLI. This works great except for the changing UUID problem. Surprised there is no way to pull in Red Hat Identity Manager (FreeIPA) |
Looks like if you configure LDAP User Storage Provider with "Import users"=OFF, then you get User IDs of the form:
f:<Provider-Component-ID>:<LDAP-User-Identifier>, which can be stable across Keycloak rebuilds. This means you must trade off performance to get a stable User ID across rebuilds though.In my use case Keycloak upgrades are built from scratch and configuration is simply scripted with admin CLI. This works great except for the changing UUID problem.
Surprised there is no way to pull in Red Hat Identity Manager (FreeIPA)
ipaUniqueIdfield to besubclaim.