Identity and Access Management
Use this section to configure external databases and directories, such as LDAP and Active Directory.
Click the User federation option on the left and select the Kerberos or LDAP provider according to your needs.
Add a Kerberos provider
Required settings
UI display name
Y
Display name of provider when linked in the Admin UI.
Kerberos realm
Y
Name of kerberos realm. For example: FOO.ORG
Server principal
Y
Full name of server principal for HTTP service including server and domain name. For example: HTTP/host.foo.org@FOO.ORG.
Key tab
Y
Location of Kerberos KeyTab file containing the credentials of server principal. For example: /etc/krb5.keytab
Debug
N
Set to On to enable the debug logging to standard output for the Krb5LoginModule. Default: Off
Allow password authentication
N
Set to On to enable the possibility of username/password authentication against Kerberos database. Default: Off
Update first login
N
Set to On to update the profile on first login. Default: Off
Cache settings
Cache policy
N
Define the Cache Policy for the storage provider. Possible options are: - DEFAULT: whatever the default settings are for the global cache. - EVICT_DAILY is a time of day every day that the cache will be invalidated. - EVICT_WEEKLY is a day of the week and time the cache will be invalidated. - MAX_LIFESPAN is the time in milliseconds that will be the lifespan of a cache entry. - NO_CACHE: choose this option if you do not want the cache to be enabled.Default: DEFAULT
Add an LDAP provider
General options
UI display name
Y
Display name of provider when linked in the Admin UI. Default: ldap
Vendor
Y
Select the LDAP vendor (provider). Possible options are: - Active Directory - Red Hat Directory Server - Tivoli - Novell eDirectory - Other Default: Active Directory
Connection and authentication settings
Connection URL
Y
Connection URL to your LDAP server.
Enable StartTLS
N
Encrypts the connection to LDAP using STARTTLS, which will disable connection pooling. Default: Off
Use Truststore SPI
N
Specifies whether LDAP connection will use the Truststore SPI with the truststore configured in standalone.xml/domain.sml. - Always means that it will always use it. - Never means that it will not use it. - Only for ldaps means that it will use it if your connection URL uses ldaps. Note that even if standalone.xml/domain.xml is not configured, the default java cacerts or certificate specified by 'javax.net.ssl.trustStore' property will be used. Default: Only for ldaps
Connection pooling
N
Determines if Identity Access Manager should use connection pooling for accessing LDAP server. If set to On, Identity Access Manager will use connection pooling for accessing LDAP server. Default: Off
Connection timeout
N
LDAP connection timeout in milliseconds.
Bind type
Y
Type of the authentication method used during LDAP bind operation. It is used in most of the requests sent to the LDAP server. Currently only 'none' (anonymous LDAP authentication) or 'simple' (bind credential + bind password authentication) mechanisms are available. Default: simple
Bind DN
Y
DN of the LDAP admin, which will be used by the Identity Access Manager.
Bind credentials
Y
Password of LDAP admin. This field can obtain its value from vault, use ${vault.ID} format.
Use the Test connection and Test authentication buttons to verify that the connection and the authentication are correctly configured.
LDAP searching and updating
Edit mode
Y
READ_ONLY is a read-only LDAP store. WRITABLE means data will be synced back to LDAP on demand. UNSYNCED means user data will be imported, but not synced back to LDAP. Default: empty
Users DN
Y
Full DN of LDAP tree where your users are. This DN is the parent of LDAP users. It could be for example 'ou=users,dc=example,dc=com' assuming that your typical user will have DN like 'uid='john',ou=users,dc=example,dc=com'.
Username LDAP attribute
Y
Name of the LDAP attribute, which is mapped as the Identity Access Manager username. For many LDAP server vendors it can be 'uid'. For Active directory it can be 'sAMAccountName' or 'cn'. The attribute should be filled for all LDAP user records you want to import from LDAP to the Identity Access Manager. Default: cn
RDN LDAP attribute
Y
Name of the LDAP attribute, which is used as RDN (top attribute) of typical user DN. Usually it's the same as the Username LDAP attribute, however it is not required. For example for Active directory, it is common to use 'cn' as RDN attribute when username attribute might be 'sAMAccountName'. Default: cn
UUID LDAP attribute
Y
Name of the LDAP attribute, which is used as a unique object identifier (UUID) for objects in LDAP. For many LDAP server vendors, it is 'entryUUID'; however some are different. For example, for Active directory it should be 'objectGUID'. If your LDAP server does not support the notion of UUID, you can use any other attribute that is supposed to be unique among LDAP users in tree. For example 'uid' or 'entryDN'. Default: objectGUID
User object classes
Y
All values of LDAP objectClass attribute for users in LDAP, divided by commas. For example: 'inetOrgPerson, organizationalPerson'. Newly created Identity Access Manager users will be written to LDAP with all those object classes and existing LDAP user records are found just if they contain all those object classes. Default: person, organizationalPerson, user
User LDAP filter
N
Additional LDAP filter for filtering searched users. Leave this empty if you don't need an additional filter. Make sure that it starts with '(' and ends with ')'.
Search scope
N
For one level, the search applies only for users in the DNs specified by User DNs. For subtree, the search applies to the whole subtree. See LDAP documentation for more details. Default: One Level
Read timeout
N
LDAP read timeout in milliseconds. This timeout applies for LDAP read operations.
Pagination
N
Whether the LDAP server supports pagination. Default: Off
Synchronization settings
Import users
N
If true, LDAP users will be imported into the Identity Access Manager DB and synced by the configured sync policies. Default: On
Sync Registrations
N
Should newly created users be created within LDAP store? Priority effects which provider is chosen to sync the new user. This setting is effectively applied only with WRITABLE edit mode. Default: On
Batch size
N
Count of LDAP users to be imported from LDAP to the Identity Access Manager within a single transaction. Default: empty
Periodic full sync
N
Set whether periodic full synchronization of LDAP users to the Identity Access Manager should be enabled or not. Default: Off
Periodic changed users sync
N
Set whether periodic synchronization of changed or newly created LDAP users to the Identity Access Manager should be enabled or not. Default: Off
Kerberos integration
Allow Kerberos authentication
N
Enable/disable HTTP authentication of users with SPNEGO/Kerberos tokens. The data about authenticated users will be provisioned from this LDAP server. Default: Off
Use Kerberos for password authentication
N
User Kerberos login module for authenticating username/password against Kerberos server instead of authenticating against LDAP server with Directory Service API Default: Off
Cache settings
Cache policy
N
Cache Policy for this storage provider. - DEFAULT is whatever the default settings are for the global cache. - EVICT_DAILY is a time of day every day that the cache will be invalidated. - EVICT_WEEKLY is a day of the week and time the cache will be invalidated. - MAX_LIFESPAN is the time in milliseconds that will be the lifespan of a cache entry. - NO_CACHE: choose this option if you do not want the cache to be enabled. Default: DEFAULT
Advanced settings
Enable the LDAPv3 password modify extended operation
N
Use the LDAPv3 Password Modify Extended Operation (RFC-3062). The password modify extended operation usually requires that LDAP user already has password in the LDAP server. So when this is used with 'Sync Registrations', it can be good to add also 'Hardcoded LDAP attribute mapper' with randomly generated initial password. Default: Off
Validate password policy
N
Determines if the Identity Access Manager should validate the password with the realm password policy before updating it. Default: Off
Trust email
N
If enabled, email provided by this provider is not verified even if verification is enabled for the realm. Default: Off
Use the Query Supported Extensions button to verify the connection to Kerberos.
Edit session timeout 🚀
To configure session settings, go to Setup → Identity Access Management → Realm settings and click the Sessions tab.
The SSO Session Idle and SSO Session Max options can be used to set session timeout:
SSO Session Idle
This setting is for OIDC clients only. If a user is inactive for longer than this timeout, the user session is invalidated. This timeout value resets when clients request authentication or send a refresh token request. A window of time is added to the idle timeout before the session invalidation takes effect.
SSO Session Max
The maximum time before a user session expires.
Last updated
