Keycloak and nested groups

Apps & App Center
, ,
#1

Hi all,

I successfully installed and set up Keycloak as the new SSO provider via univention-app.

I then quickly noticed that nested groups from the LDAP are not resolved.

group: all < group: all.ch < group: all.ch.basel < user: maxmuster

In the OIDC token you see only contain the group all.ch.basel 

          'groups' => [
                        '/Domain Users',
                        '/all.ch.basel'
                      ],

Is it possible to get the keycloak to resolve the nested groups correctly?
The memberOf in the user object can only list the direct groups, so it doesn’t help me either.

Greez
AlteSocke

#2

I guess I have to correct myself here.

group: all < group: all.ch < group: all.ch.basel < user: maxmuster

seems to work.

However, we have the following scenario which does not work.

group: access-app1 < group: all < group: all.ch < group: all.ch.basel < user: maxmuster
group: access-app2 < group: all < group: all.ch < group: all.ch.basel < user: maxmuster

Greez
AlteSocke

#3

https://forge.univention.org/bugzilla/show_bug.cgi?id=55787

#4

A question for Univention:

If you use keycloak as a new SSO provider, but it doesn’t support nested groups, how do you get the builtin group Administrators into the keycloak correctly?

This group has nested groups and failed when opened in keycloak.

TEST-root@vmadfchucs01:~# univention-ldapsearch cn=administrators
# extended LDIF
#
# LDAPv3
# base <dc=int,dc=tux42,dc=ch> (default) with scope subtree
# filter: cn=administrators
# requesting: ALL
#

# Administrators, Builtin, int.tux42.ch
dn: cn=Administrators,cn=Builtin,dc=int,dc=tux42,dc=ch
sambaGroupType: 2
cn: Administrators
objectClass: top
objectClass: univentionGroup
objectClass: posixGroup
objectClass: univentionObject
objectClass: sambaGroupMapping
description: Administrators have complete and unrestricted access to the computer/domain
sambaSID: S-1-5-32-544
gidNumber: 5054
univentionObjectType: groups/group
univentionGroupType: -2147483643
memberUid: Administrator
memberUid: api-user
uniqueMember: uid=administrator,cn=users,dc=int,dc=tux42,dc=ch
uniqueMember: cn=domain admins,cn=groups,dc=int,dc=tux42,dc=ch
uniqueMember: cn=enterprise admins,cn=groups,dc=int,dc=tux42,dc=ch
uniqueMember: uid=api-user,cn=users,ou=internal,dc=int,dc=tux42,dc=ch

image

Best thanks for the answer
Greez
AlteSocke

#5

Hi

My Problem is that I even can’t get the Groups listed.

How you configured Keycloak as it shows Groups?

I’m very new with UCS and Keycloak.

Thanks

#6

hi @brix

Create a new mapper in the sser federation: 3. Configuration — Keycloak app 22.0.3

Greez
AlteSocke

#7

Hi @AlteSockenSuppe

Many thanks! It worked! And as usual…RTFM! :smirk:

As I’m used to…hours of try and error saves me from minutes of reading manuals! :wink: :rofl:

Best regards

Mastodon