Class GroupMapper

# keycloak.ldap.GroupMapper

Allows for creating and managing group mappers for Keycloak users federated via LDAP.

The LDAP group mapper can be used to map an LDAP user's groups from some DN to Keycloak groups. This group mapper will also create the groups within Keycloak if they do not already exist.

Example Usage

using Pulumi;
using Keycloak = Pulumi.Keycloak;

class MyStack : Stack
{
public MyStack()
{
    var realm = new Keycloak.Realm(&quot;realm&quot;, new Keycloak.RealmArgs
    {
        Enabled = true,
        Realm = &quot;test&quot;,
    });
    var ldapUserFederation = new Keycloak.Ldap.UserFederation(&quot;ldapUserFederation&quot;, new Keycloak.Ldap.UserFederationArgs
    {
        BindCredential = &quot;admin&quot;,
        BindDn = &quot;cn=admin,dc=example,dc=org&quot;,
        ConnectionUrl = &quot;ldap://openldap&quot;,
        RdnLdapAttribute = &quot;cn&quot;,
        RealmId = realm.Id,
        UserObjectClasses = 
        {
            &quot;simpleSecurityObject&quot;,
            &quot;organizationalRole&quot;,
        },
        UsernameLdapAttribute = &quot;cn&quot;,
        UsersDn = &quot;dc=example,dc=org&quot;,
        UuidLdapAttribute = &quot;entryDN&quot;,
    });
    var ldapGroupMapper = new Keycloak.Ldap.GroupMapper(&quot;ldapGroupMapper&quot;, new Keycloak.Ldap.GroupMapperArgs
    {
        GroupNameLdapAttribute = &quot;cn&quot;,
        GroupObjectClasses = 
        {
            &quot;groupOfNames&quot;,
        },
        LdapGroupsDn = &quot;dc=example,dc=org&quot;,
        LdapUserFederationId = ldapUserFederation.Id,
        MemberofLdapAttribute = &quot;memberOf&quot;,
        MembershipAttributeType = &quot;DN&quot;,
        MembershipLdapAttribute = &quot;member&quot;,
        MembershipUserLdapAttribute = &quot;cn&quot;,
        RealmId = realm.Id,
    });
}

}

Argument Reference

The following arguments are supported:

realm_id - (Required) The realm that this LDAP mapper will exist in.
ldap_user_federation_id - (Required) The ID of the LDAP user federation provider to attach this mapper to.
name - (Required) Display name of this mapper when displayed in the console.
ldap_groups_dn - (Required) The LDAP DN where groups can be found.
group_name_ldap_attribute - (Required) The name of the LDAP attribute that is used in group objects for the name and RDN of the group. Typically cn.
group_object_classes - (Required) Array of strings representing the object classes for the group. Must contain at least one.
preserve_group_inheritance - (Optional) When true, group inheritance will be propagated from LDAP to Keycloak. When false, all LDAP groups will be propagated as top level groups within Keycloak.
ignore_missing_groups - (Optional) When true, missing groups in the hierarchy will be ignored.
membership_ldap_attribute - (Required) The name of the LDAP attribute that is used for membership mappings.
membership_attribute_type - (Optional) Can be one of DN or UID. Defaults to DN.
membership_user_ldap_attribute - (Required) The name of the LDAP attribute on a user that is used for membership mappings.
groups_ldap_filter - (Optional) When specified, adds an additional custom filter to be used when querying for groups. Must start with ( and end with ).
mode - (Optional) Can be one of READ_ONLY or LDAP_ONLY. Defaults to READ_ONLY.
user_roles_retrieve_strategy - (Optional) Can be one of LOAD_GROUPS_BY_MEMBER_ATTRIBUTE, GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_GROUPS_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_GROUPS_BY_MEMBER_ATTRIBUTE.
memberof_ldap_attribute - (Optional) Specifies the name of the LDAP attribute on the LDAP user that contains the groups the user is a member of. Defaults to memberOf.
mapped_group_attributes - (Optional) Array of strings representing attributes on the LDAP group which will be mapped to attributes on the Keycloak group.
drop_non_existing_groups_during_sync - (Optional) When true, groups that no longer exist within LDAP will be dropped in Keycloak during sync. Defaults to false.

Inheritance

System.Object

Resource

CustomResource

GroupMapper

Inherited Members

CustomResource.Id

Resource.GetResourceType()

Resource.GetResourceName()

Resource.Urn

System.Object.Equals(System.Object)

System.Object.Equals(System.Object, System.Object)

System.Object.GetHashCode()

System.Object.GetType()

System.Object.MemberwiseClone()

System.Object.ReferenceEquals(System.Object, System.Object)

System.Object.ToString()

Namespace: Pulumi.Keycloak.Ldap

Assembly: Pulumi.Keycloak.dll

Syntax

public class GroupMapper : CustomResource

Constructors

View Source

GroupMapper(String, GroupMapperArgs, CustomResourceOptions)

Create a GroupMapper resource with the given unique name, arguments, and options.

Declaration

public GroupMapper(string name, GroupMapperArgs args, CustomResourceOptions options = null)

Parameters

Type	Name	Description
System.String	name	The unique name of the resource
GroupMapperArgs	args	The arguments used to populate this resource's properties
CustomResourceOptions	options	A bag of options that control this resource's behavior

Properties

View Source

DropNonExistingGroupsDuringSync

Declaration

public Output<bool?> DropNonExistingGroupsDuringSync { get; }

Property Value

Type	Description
Output<System.Nullable<System.Boolean>>

View Source

GroupNameLdapAttribute

Declaration

public Output<string> GroupNameLdapAttribute { get; }

Property Value

Type	Description
Output<System.String>

View Source

GroupObjectClasses

Declaration

public Output<ImmutableArray<string>> GroupObjectClasses { get; }

Property Value

Type	Description
Output<System.Collections.Immutable.ImmutableArray<System.String>>

View Source

GroupsLdapFilter

Declaration

public Output<string> GroupsLdapFilter { get; }

Property Value

Type	Description
Output<System.String>

View Source

IgnoreMissingGroups

Declaration

public Output<bool?> IgnoreMissingGroups { get; }

Property Value

Type	Description
Output<System.Nullable<System.Boolean>>

View Source

LdapGroupsDn

Declaration

public Output<string> LdapGroupsDn { get; }

Property Value

Type	Description
Output<System.String>

View Source

LdapUserFederationId

The ldap user federation provider to attach this mapper to.

Declaration

public Output<string> LdapUserFederationId { get; }

Property Value

Type	Description
Output<System.String>

View Source

MappedGroupAttributes

Declaration

public Output<ImmutableArray<string>> MappedGroupAttributes { get; }

Property Value

Type	Description
Output<System.Collections.Immutable.ImmutableArray<System.String>>

View Source

MemberofLdapAttribute

Declaration

public Output<string> MemberofLdapAttribute { get; }

Property Value

Type	Description
Output<System.String>

View Source

MembershipAttributeType

Declaration

public Output<string> MembershipAttributeType { get; }

Property Value

Type	Description
Output<System.String>

View Source

MembershipLdapAttribute

Declaration

public Output<string> MembershipLdapAttribute { get; }

Property Value

Type	Description
Output<System.String>

View Source

MembershipUserLdapAttribute

Declaration

public Output<string> MembershipUserLdapAttribute { get; }

Property Value

Type	Description
Output<System.String>

View Source

Mode

Declaration

public Output<string> Mode { get; }

Property Value

Type	Description
Output<System.String>

View Source

Name

Display name of the mapper when displayed in the console.

Declaration

public Output<string> Name { get; }

Property Value

Type	Description
Output<System.String>

View Source

PreserveGroupInheritance

Declaration

public Output<bool?> PreserveGroupInheritance { get; }

Property Value

Type	Description
Output<System.Nullable<System.Boolean>>

View Source

RealmId

The realm in which the ldap user federation provider exists.

Declaration

public Output<string> RealmId { get; }

Property Value

Type	Description
Output<System.String>

View Source

UserRolesRetrieveStrategy

Declaration

public Output<string> UserRolesRetrieveStrategy { get; }

Property Value

Type	Description
Output<System.String>

Methods

View Source

Get(String, Input<String>, GroupMapperState, CustomResourceOptions)

Get an existing GroupMapper resource's state with the given name, ID, and optional extra properties used to qualify the lookup.

Declaration

public static GroupMapper Get(string name, Input<string> id, GroupMapperState state = null, CustomResourceOptions options = null)

Parameters

Type	Name	Description
System.String	name	The unique name of the resulting resource.
Input<System.String>	id	The unique provider ID of the resource to lookup.
GroupMapperState	state	Any extra arguments used during the lookup.
CustomResourceOptions	options	A bag of options that control this resource's behavior

Returns

Type	Description
GroupMapper