In the OIDC token you see only contain the group all.ch.basel
'groups' => [
'/Domain Users',
'/all.ch.basel'
],
Is it possible to get the keycloak to resolve the nested groups correctly?
The memberOf in the user object can only list the direct groups, so it doesn’t help me either.
If you use keycloak as a new SSO provider, but it doesn’t support nested groups, how do you get the builtin group Administrators into the keycloak correctly?
This group has nested groups and failed when opened in keycloak.
TEST-root@vmadfchucs01:~# univention-ldapsearch cn=administrators
# extended LDIF
#
# LDAPv3
# base <dc=int,dc=tux42,dc=ch> (default) with scope subtree
# filter: cn=administrators
# requesting: ALL
#
# Administrators, Builtin, int.tux42.ch
dn: cn=Administrators,cn=Builtin,dc=int,dc=tux42,dc=ch
sambaGroupType: 2
cn: Administrators
objectClass: top
objectClass: univentionGroup
objectClass: posixGroup
objectClass: univentionObject
objectClass: sambaGroupMapping
description: Administrators have complete and unrestricted access to the computer/domain
sambaSID: S-1-5-32-544
gidNumber: 5054
univentionObjectType: groups/group
univentionGroupType: -2147483643
memberUid: Administrator
memberUid: api-user
uniqueMember: uid=administrator,cn=users,dc=int,dc=tux42,dc=ch
uniqueMember: cn=domain admins,cn=groups,dc=int,dc=tux42,dc=ch
uniqueMember: cn=enterprise admins,cn=groups,dc=int,dc=tux42,dc=ch
uniqueMember: uid=api-user,cn=users,ou=internal,dc=int,dc=tux42,dc=ch
