CODEWITHSUNDEEP
ldapkeycloakfreeipa
Alejandro T
Alejandro T

Reputation: 349

Keycloak minimal privileges to bind to LDAP

Our goal is to manage FreeIPA users passwords from Keycloak, this works when we use the admin user from FreeIPA to bind from Keycloak, e.g. in the Keycloak > User Federation > LDAP > Bind DN: uid=admin,cn=users,cn=accounts,dc=example,dc=com

When using a non privileged user with only the permissions to manage passwords we can synchronize the user but listing the users from keycloak returns an error: 'an unexpected server error has occurred'

If we add the non privileged user to the admin group in LDAP it also works

These are the commands that we used to add the permission to manage passwords:

ipa role-add "Self Password Reset"
ipa role-add-member "Self Password Reset" --users="ldap-passwd-reset"
ipa role-add-privilege "Self Password Reset" --privileges="Modify Users and Reset passwords"
ipa role-add-privilege "Self Password Reset" --privileges="Password Policy Readers"
ipa role-add-privilege "Self Password Reset" --privileges="Kerberos Ticket Policy Readers"
ipa permission-mod "System: Change User password" --includedattrs="krbloginfailedcount"

My question is what are the minimum privileges that a user needs to be able to manage LDAP passwords from Keycloak without being member of the admin groups

Upvotes: 2

Views: 881

Answers (0)

Related Questions