LDAP configuration
Using this API, user records will be added/update to the authorization server.
Resource Informations
| Name | Value |
|---|---|
| Requires authentication? | Yes |
| Rate limited? | No |
Request
Request headers
| Key | Value |
|---|---|
| Authorization | Bearer token |
| Content-Type | application/json |
HTTP request URL for SSMS
POST https://{tenantId}.{hostname}/digitanium/v4/ldap
HTTP request URL for SHIFT
POST https://{hostname}/auth/realms/{tenantId}/v3_ldap/components
note
At this moment, this API is applicable for SSMS based installations.
note
API requests must be made over https. Calls made over plain http will fail.
Parameters
No parameter fields are required.
Request body (* Required)
| Field Name | Type | Description |
|---|---|---|
| *id | String | Unique id for LDAP config. ("id": "configid5") |
| *name | String | Display name of LDAP config. ("name": "ldap_xxx") |
| *providerType | String | Provider type for config.("providerType": "org.keycloak.storage.UserStorageProvider") |
| *config | Object | LDAP basic cofigurations. |
| enabled | List of boolean | If provider is disabled it will not be considered for queries and imported users will be disabled and read-only until the provider is enabled again. |
| priority | List of String (Integer parsed) | Priority of provider when doing a user lookup. Lowest first. |
| importEnabled | List of boolean | If true, LDAP users will be imported into Digitanium Identitiy DB and synced via the configured sync policies. |
| editMode | List of String | READ_ONLY is a read-only LDAP store. WRITABLE means data will be synced back to LDAP on demand. UNSYNCED means user data will be imported, but not synced back to LDAP. |
| syncRegistrations | List of boolean | Should newly created users be created within LDAP store? Priority effects which provider is chose to sync the new user. |
| *vendor | List of String | LDAP Vendor (Provider). Based on vendor name usernameLDAPAttribute, uuidLDAPAttribute, userObjectClasses, rdnLDAPAttribute are getting update. Use the following values for specific vendors, Active Directory=ad, Red Hat Directory Server=rhds, Tivoli=tivoli, Novell eDirectory=edirectory, Other=other |
| *connectionUrl | List of String | Connection URL to your LDAP server. |
| *usersDn | List of String | Full DN of LDAP tree where your users are. This DN is parent of LDAP users. It could be for example 'ou=users,dc=example,dc=com' assuming that your typical user will have DN like 'uid=john,ou=users,dc=example,dc=com' |
| *authType | List of String | LDAP Authentication type. Right now just 'none' (anonymous LDAP authentication) or 'simple' (Bind credential + Bind password authentication) mechanisms are available |
| *bindDn | List of String | DN of LDAP admin, which will be used by mIDentity to access LDAP server |
| *bindCredential | List of String | Password for LDAP Admin |
| customUserSearchFilter | List of String | Additional LDAP Filter for filtering searched users. Leave this empty if you don't need additional filter. Make sure that it starts with '(' and ends with ')' |
| searchScope | List of String (Integer parsed) | For one level, we search for users just in DNs specified by User DNs. For subtree, we search in whole of their subtree. See LDAP documentation for more details |
| validatePasswordPolicy | List of boolean | Does mIDentity should validate the password with the realm password policy before updating it |
| useTruststoreSpi | List of String | Specifies whether LDAP connection will use the truststore SPI with the truststore configured in standalone.xml/domain.xml. 'Always' means that it will always use it. 'Never' means that it won't use it. 'Only for ldaps' means that it will use if your connection URL use ldaps. Note even if standalone.xml/domain.xml is not configured, the default Java cacerts or certificate specified by 'javax.net.ssl.trustStore' property will be used. |
| connectionPooling | List of boolean | Use connection pooling for accessing LDAP server. |
| connectionTimeout | List of String (Integer parsed) | LDAP Connection Timeout in milliseconds |
| readTimeout | List of String (Integer parsed) | LDAP Read Timeout in milliseconds. This timeout applies for LDAP read operations |
| pagination | List of boolean | If LDAP suppoer pagination we can enable or disable it. |
| allowKerberosAuthentication | List of boolean | Enable/disable HTTP authentication of users with SPNEGO/Kerberos tokens. The data about authenticated users will be provisioned from this LDAP server |
| *kerberosRealm | List of String | (consider if allowKerberosAuthentication = true) Name of kerberos realm. For example FOO.ORG |
| *serverPrincipal | List of String | (consider if allowKerberosAuthentication = true) Full name of server principal for HTTP service including server and domain name. For example HTTP/host.foo.org@FOO.ORG |
| *keyTab | List of String | (consider if allowKerberosAuthentication = true) Location of Kerberos KeyTab file containing the credentials of server principal. For example /etc/krb5.keytab |
| debug | List of boolean | (consider if allowKerberosAuthentication = true) Enable/disable debug logging to standard output for Krb5LoginModule. |
| useKerberosForPasswordAuthentication | List of boolean | Use Kerberos login module for authenticate username/password against Kerberos server instead of authenticating against LDAP server with Directory Service API. |
| batchSizeForSync | List of String (Integer parsed) | Count of LDAP users to be imported from LDAP to Digitanium Identitiy within single transaction. ("batchSizeForSync": ["1000"]) |
| fullSyncEnabled | List of boolean | Does periodic full synchronization of LDAP users to Keycloak should be enabled or not |
| fullSyncPeriod | List of String (Integer parsed) | Period for full synchronization in seconds |
| changedSyncEnabled | List of boolean | Does periodic synchronization of changed or newly created LDAP users to Keycloak should be enabled or not |
| changedSyncPeriod | List of String (Integer parsed) | Period for synchronization of changed or newly created LDAP users in seconds |
| cachePolicy | List of String | Cache Policy for this storage provider. 'DEFAULT' is whatever the default settings are for the global cache. 'EVICT_DAILY' is a time of day every day that the cache will be invalidated. 'EVICT_WEEKLY' is a day of the week and time the cache will be invalidated. 'MAX-LIFESPAN' is the time in milliseconds that will be the lifespan of a cache entry. |
| evictionMinute | List of String (Integer parsed) | Minute of day the entry will become invalid on. (value belween 0 and 59) |
| evictionHour | List of String (Integer parsed) | Hour of day the entry will become invalid on. (value belween 0 and 23) |
| evictionDay | List of String (Integer parsed) | Day of the week the entry will become invalid on (value belween 1 and 7 i.e. 1 - Sunday, 2 - Monday...., 7 - Saturday) |
| maxLifespan | List of String (Integer parsed) | Max lifespan of cache entry in milliseconds. |
Sample Request
{
"id": "configid5",
"name": "ldap_xxx",
"providerType": "org.keycloak.storage.UserStorageProvider",
"config": {
"fullSyncPeriod": ["-1"],
"pagination": ["true"],
"connectionPooling": ["true"],
"usersDn": ["dc=xxxx,dc=com"],
"cachePolicy": ["DEFAULT"],
"useKerberosForPasswordAuthentication": ["false"],
"importEnabled": ["true"],
"enabled": ["true"],
"bindCredential": ["**********"],
"changedSyncPeriod": ["-1"],
"bindDn": ["cn=xxxx,dc=xxxx,dc=com"],
"lastSync": [“123123123”],
"vendor": ["other"],
"allowKerberosAuthentication": ["false"],
"connectionUrl": ["ldap://52.210.11.165"],
"syncRegistrations": ["false"],
"authType": ["simple"],
"customUserSearchFilter": ["(uid=*)"],
"debug": ["false"],
"searchScope": ["2"],
"useTruststoreSpi": ["ldapsOnly"],
"priority": ["0"],
"editMode": ["WRITABLE"],
"validatePasswordPolicy": ["false"],
"batchSizeForSync": ["1000"]
}
}
Response
| Field Name | Type | Description |
|---|---|---|
| message | String | Message explains result of the API call. Refer Response status Information for details. |
| status | String | The status of the API call. Refer Response status Information for details. |
| subSystem | Integer | subSystem categorizes the type of API that has been called. Refer Subsystem details for details. |
Sample Response
{
"message": "Successfully created LDAP service provider",
"status": "OK",
"subSystem": 9
}
Response Status Information
| Status Code | Status | Message |
|---|---|---|
| 200 | OK | Successfully created LDAP service provider |
| 400 | BAD_REQUEST | LDAP Configuration is mandatory |
| 401 | Unauthorized | HTTP 401 Unauthorized |
| 409 | CONFLICT | LDAP Component Id already exists! |